[Puppo]

Adds a manually dispatched release workflow with patch, minor, and major choices, enabling approval-gated npm trusted publishing through the shared Fastify workflow.

The release job grants id-token: write and contents: write and pins fastify/workflows/.github/workflows/reusable-release.yml to b1a11bce713bc857e52b2231fec3c89071ad3135. The shared workflow uses the release environment, commits/pushes the version bump, publishes with npm provenance, and creates the GitHub Release.

Adds release:build: npm run prepare to generate Swagger UI static assets explicitly after dependency installation with scripts disabled. Preserves the existing prepare and prepublishOnly hooks.

Part of the Lifecycle-1 rollout batch, following the pilot in fastify/fastify-accepts#231.

Validation

Local validation with Node.js 24.21.0 and npm 11.19.0:

• npm install --ignore-scripts --no-audit --no-fund passed.
• npm run lint passed.
• npm test passed.
• npm run release:build passed.
• Actionlint 1.7.12 passed; dispatch choices, permissions, reusable-workflow inputs, pinned SHA, and inherited release environment verified.
• npm pack: verified runtime entry index.js, declaration entry types/index.d.ts, and unchanged package version 6.1.1.

Verified all required Swagger UI static files, branding files, OAuth redirect assets, and csp.json in the tarball.

Admin setup before the first release

These settings are not changed by this PR and remain unverified:

• Configure the release environment with required reviewer team fastify/release and deployment access exclusively for branch main; check for extra branch/tag policies.
• Confirm branch protection/rulesets allow the shared workflow to push the version commit using GITHUB_TOKEN.
• Configure the npm GitHub Actions Trusted Publisher for @fastify/swagger-ui: label manual-gha-release, organization fastify, repository fastify-swagger-ui, workflow filename release.yml, environment release, Allow publish enabled.
• After review, setup, and merge, validate one real release: approval gate/reviewer notifications, package contents/provenance, version commit, tag, and GitHub Release. Use manual Discord notification if necessary.

No version bump, npm publication, release dispatch, or administrative settings/access changes were performed while preparing this draft.

Additional validation notes:

• npm test used per-process NODE_OPTIONS addition --dns-result-order=ipv4first for local networking; no workflow environment changes.

Separate Playwright browser E2E suite was not run locally; verify the upstream Playwright workflow before merging. The configured npm test command (unit and declarations) passed. All 12 required static files are nonempty and csp.json parses successfully.

[ilteoood]

Approved via Hermes (richiesta utente).

[Eomm]

I think we miss the release:build script here:

fastify-swagger-ui/package.json

Lines 10 to 11 in caa809d

	"lint:fix": "eslint --fix",
	"prepare": "node scripts/prepare-swagger-ui",

I suspect these script are not running ATM (or will not run in nodejs 27)

[Tony133]

Credo che release:buildqui ci sia sfuggito il copione:

fastify-swagger-ui/package.json

Lines 10 to 11 in caa809d

	"lint:fix": "eslint --fix",
	"prepare": "node scripts/prepare-swagger-ui",

Sospetto che questi script al momento non siano in esecuzione (o che non funzioneranno con Node.js 27).

I thought it was for the TypeScript build—sorry 😅

[Eomm]

ts is the main user, but here we are packing the swagger html and js files into our module

[Tony133]

ts is the main user, but here we are packing the swagger html and js files into our module

ok I'm creating a PR to fix it 🙏🏻