From 058a7aee181d02c89148196a6de69ff406e3afee Mon Sep 17 00:00:00 2001
From: Sergiu Oala <soala@netflix.com>
Date: Fri, 4 Sep 2026 08:42:52 +0000
Subject: [PATCH] ci: npm stage publish release+candidates

---
 .github/prerelease-config.json       | 11 ++++++++++
 .github/prerelease-manifest.json     |  3 +++
 .github/release-config.json          | 18 ++++++++++++++++
 .github/release-manifest.json        |  3 +++
 .github/workflows/npm-publish.yml    | 11 ++++++++--
 .github/workflows/release-please.yml | 32 ++++++++++++++++++++++------
 6 files changed, 70 insertions(+), 8 deletions(-)
 create mode 100644 .github/prerelease-config.json
 create mode 100644 .github/prerelease-manifest.json
 create mode 100644 .github/release-config.json
 create mode 100644 .github/release-manifest.json

diff --git a/.github/prerelease-config.json b/.github/prerelease-config.json
new file mode 100644
index 00000000..14cf864c
--- /dev/null
+++ b/.github/prerelease-config.json
@@ -0,0 +1,11 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "release-type": "node",
+  "include-component-in-tag": false,
+  "versioning": "prerelease",
+  "prerelease": true,
+  "prerelease-type": "rc",
+  "packages": {
+    ".": {}
+  }
+}
diff --git a/.github/prerelease-manifest.json b/.github/prerelease-manifest.json
new file mode 100644
index 00000000..9259d402
--- /dev/null
+++ b/.github/prerelease-manifest.json
@@ -0,0 +1,3 @@
+{
+  ".": "12.0.0"
+}
diff --git a/.github/release-config.json b/.github/release-config.json
new file mode 100644
index 00000000..0df416e8
--- /dev/null
+++ b/.github/release-config.json
@@ -0,0 +1,18 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "release-type": "node",
+  "include-component-in-tag": false,
+  "versioning": "default",
+  "prerelease": false,
+  "packages": {
+    ".": {
+      "extra-files": [
+        {
+          "type": "json",
+          "path": ".github/prerelease-manifest.json",
+          "jsonpath": "$[\".\"]"
+        }
+      ]
+    }
+  }
+}
diff --git a/.github/release-manifest.json b/.github/release-manifest.json
new file mode 100644
index 00000000..9259d402
--- /dev/null
+++ b/.github/release-manifest.json
@@ -0,0 +1,3 @@
+{
+  ".": "12.0.0"
+}
diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 2fbefe09..226e64c5 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -86,5 +86,12 @@ jobs:
           node-version: 26.x
           registry-url: https://registry.npmjs.org
 
-      - name: publish to npm
-        run: npm publish --provenance
+      - name: npm stage publish
+        env:
+          RELEASE_TAG: ${{ inputs.tag }}
+        run: |
+          if [[ "$RELEASE_TAG" == *-rc* ]]; then
+            npm stage publish --provenance --tag rc
+          else
+            npm stage publish --provenance
+          fi
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 3dc4a36b..f71273fc 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -11,24 +11,44 @@ permissions:
   # npm-publish is dispatched explicitly below. workflow_dispatch is one of the
   # few events that always creates a run, even from GITHUB_TOKEN.
   actions: write
+
+concurrency:
+  group: release-please-${{ github.ref_name }}
+  cancel-in-progress: false
+
 name: release-please
 jobs:
   release-please:
     runs-on: ubuntu-latest
     steps:
       - uses: googleapis/release-please-action@v5
-        id: release
+        id: prerelease
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          config-file: .github/prerelease-config.json
+          manifest-file: .github/prerelease-manifest.json
+          target-branch: ${{ github.ref_name }}
+
+      # Once an RC PR is merged and tagged, replace it with the stable Release
+      # PR. The stable config also synchronizes the prerelease manifest when
+      # that stable PR is eventually merged.
+      - name: create stable Release PR
+        if: >-
+          steps.prerelease.outputs.releases_created == 'true' &&
+          contains(steps.prerelease.outputs.tag_name, '-rc')
+        uses: googleapis/release-please-action@v5
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          release-type: node
+          config-file: .github/release-config.json
+          manifest-file: .github/release-manifest.json
           target-branch: ${{ github.ref_name }}
 
-      # releases_created is only true on the run that tagged a release, which is
-      # the run triggered by merging the release PR.
+      # The prerelease action recognizes merges of both RC and stable Release
+      # PRs. It creates the corresponding tag and GitHub Release in either case.
       - name: trigger npm-publish
-        if: steps.release.outputs.releases_created == 'true'
+        if: steps.prerelease.outputs.releases_created == 'true'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GH_REPO: ${{ github.repository }}
-          TAG: ${{ steps.release.outputs.tag_name }}
+          TAG: ${{ steps.prerelease.outputs.tag_name }}
         run: gh workflow run npm-publish.yml --ref "$GITHUB_REF_NAME" -f tag="$TAG"