fix(ci): bump release version with npm version and pass the tag via env (PER-16501)

[Kyzgor]

Summary

• Sets the release version with npm version <tag> --no-git-tag-version --allow-same-version --ignore-scripts instead of sed. npm version edits only the top-level version. The sed also rewrote scripts.version, which is 2.5.2 on main and was 2.7.6 in the published 2.7.6 package.
• Restores scripts.version to standard-version.
• Passes the release tag and the prerelease flag through env: instead of ${{ }} inside run:. Before this, a tag such as v2.7.6$(cmd) would run cmd in the publish job.
• Validates the tag with semver.valid() before bumping, and checks the result afterwards. The package.json version must equal the normalized tag, and scripts.version must still be standard-version.
• Adds 30 unit tests that run the workflow's own bump and publish scripts against temporary packages.
• Up to date with main (merged, not rebased); npm Trusted Publishing (OIDC) and the API-key masking are unchanged.

Linear

• Fixes PER-16501: Node SDK: publish workflow corrupts scripts.version and interpolates the release tag into the shell

Closes #89.

Details

Tag handling (.github/workflows/node_sdk_publish.yaml)

Release tag	package.json version
v2.7.7, 2.7.7	2.7.7
v2.7.7-rc, 2.7.7-rc.1	2.7.7-rc, 2.7.7-rc.1; a GitHub prerelease publishes with --tag rc
v2.7.7+build.1	2.7.7 (npm drops build metadata)
the current version, e.g. on a re-run	unchanged; allowed
minor, patch, from-git, release-2.7.7, vv2.7.7, 2.7, empty, shell syntax	step fails before package.json changes

--ignore-scripts skips the version lifecycle script, so standard-version doesn't run during the release.

Tests (src/tests/unit/release-workflow.spec.ts, run by yarn test:unit)

The tests read the run: blocks for "Bump version at package.json" and "Publish package to NPM" from the workflow file itself and run them in temporary git repositories. They cover:

• every row of the table, including re-runs;
• rejection without executing injected commands;
• npm failures, and an npm run that exits 0 but leaves the wrong version;
• a corrupted scripts.version;
• dist-tag selection and exit-code propagation in the publish step.

Testing

• yarn build: passes
• yarn lint: 0 errors (7 existing warnings)
• yarn test:unit: 78 passed
• yarn test:module-imports: 9 passed
• zizmor: reports no new findings compared with main
• actionlint: its one warning (SC2086, an unquoted $GITHUB_ENV in the existing "Creation env" step) is also on main

Notes

• The bump step uses the semver package from the installed dependencies. It is present transitively, not as a direct dependency. yarn install runs earlier in the job.
• Existing issue, not changed here: prepare-release calls doc:html and doc:publish, which don't exist.
• ci: pin actions to SHA and run full test suite on PRs #131 (being folded into permitio 3.0.0: refactor SDK APIs, tests, and release validation #134) pins the actions in this workflow to SHAs; it touches different lines.

Original change by @Kyzgor; the merge with main, the env/validation changes and the tests were added by the maintainers.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PSoip6dghQ62bLQ6GBMwTA

[Kyzgor]

The security/snyk (permit) check is in an ERROR state here. This PR changes no dependencies — it only edits the publish workflow's version-bump step and restores a corrupted scripts.version string in package.json — so this looks like an external/integration failure on the Snyk side for fork PRs rather than a vulnerability introduced by the change. Could a maintainer re-run it (or waive it for this fork PR)? Happy to help if anything is needed on my end.

[zeevmoney]

Correct fix — npm version is JSON-aware and only mutates the top-level field, and it strips a leading v from the tag. One small nit.

[Copilot]

Pull request overview

This PR fixes the Node SDK publish workflow’s version-bump step to avoid corrupting package.json by replacing a greedy sed rewrite with npm version, and restores the previously corrupted scripts.version entry.

Changes:

• Replace the CI sed-based version bump with npm version ... --no-git-tag-version --allow-same-version --ignore-scripts to only update the top-level version field.
• Restore package.json’s scripts.version back to standard-version.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Restores scripts.version to standard-version so release tooling isn’t broken.
.github/workflows/node_sdk_publish.yaml	Uses npm version (JSON-aware) instead of a greedy sed substitution during publish.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Kyzgor]

Thanks — pushed an update:

• Added the inline comment explaining the three flags (--no-git-tag-version, --allow-same-version, --ignore-scripts).
• On the leading v: npm version strips it and validates semver, where the old sed wrote the tag verbatim — called out in the body. For the repo's bare-semver tags it's equivalent; the v-strip only matters on a v-prefixed tag (an improvement, not a behaviour change for current releases).
• Added a one-line post-bump assertion so the original scripts.version corruption can't silently come back.

Rebased on main; the lone red check is the known fork Snyk quota error.

[zeevmoney]

Approved. Verified with main plus #121 and #135: build, lint and unit tests pass (including the 30 release-workflow tests), and CI is green.