From 0d930fdf068aa60543bb235b0a7387bbb0f835da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adri=C3=A0=20Arrufat?= <adria.arrufat@gmail.com>
Date: Thu, 17 Sep 2026 14:25:33 +0200
Subject: [PATCH] ci: dispatch the lightpanda-js npm build on version tags

Adds an update-js-package job next to update-python-package: on
version-shaped tags it starts the npm workflow on lightpanda-io/lightpanda-js
with the distribution app token, the same permission the python dispatch
uses. That workflow bundles this release's binaries into the npm packages,
waits for the npm environment approval there, and records its own release.
The already-released guard keeps a re-run from dispatching twice.
---
 .github/workflows/release.yml | 38 +++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 67d83551a..e79b139be 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -269,3 +269,41 @@ jobs:
             --field release="$RELEASE" \
             --field publish=pypi
           echo "dispatched; the publish waits for pypi environment approval on $PYTHON_REPO"
+
+  update-js-package:
+    # Version tags only (never nightly): start the npm build on
+    # lightpanda-js. It bundles this release's binaries, publishes to npm
+    # once a maintainer approves the `npm` environment deployment there, and
+    # then records the matching release on that repo itself — the app token
+    # below can start workflows there but cannot write repository contents.
+    if: github.ref_type == 'tag'
+    needs: [build-linux, build-macos]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Generate token for lightpanda-js
+        id: app-token
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
+        with:
+          app-id: ${{ secrets.DISTRIBUTION_APP_ID }}
+          private-key: ${{ secrets.DISTRIBUTION_APP_PRIVATE_KEY }}
+          owner: lightpanda-io
+          repositories: lightpanda-js
+
+      - name: Start the lightpanda-js npm build
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          JS_REPO: lightpanda-io/lightpanda-js
+        run: |
+          if ! echo "$RELEASE" | grep -qE '^v?[0-9]+(\.[0-9]+)+$'; then
+            echo "tag $RELEASE is not version-shaped; not releasing to npm"
+            exit 0
+          fi
+          if gh release view "$RELEASE" --repo "$JS_REPO" >/dev/null 2>&1; then
+            echo "release $RELEASE already exists on $JS_REPO; nothing to do"
+            exit 0
+          fi
+          gh workflow run npm.yml --repo "$JS_REPO" \
+            --field release="$RELEASE" \
+            --field publish=npm
+          echo "dispatched; the publish waits for npm environment approval on $JS_REPO"