From a52e506c1260df08e403fb5c01a49b972a8eac34 Mon Sep 17 00:00:00 2001
From: sidgaikwad <gaikwadsiddharth039@gmail.com>
Date: Fri, 4 Sep 2026 12:49:40 +0530
Subject: [PATCH] ci: publish releases from CI, with a changelog
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Publishing was a manual `npm run build && npm publish` from a maintainer's
machine. The consequences: the repo has no git tags, no GitHub Releases,
no changelog, and packages go out without provenance — so there is no
record anywhere of what changed between 1.0.0, 1.0.1 and 1.0.2.

Add release.yml, triggered on a v* tag. It re-runs lint, typecheck, tests
and build, then publishes with --provenance and creates the GitHub Release
with generated notes.

It also verifies the tag matches package.json before publishing: a
mismatch would put the wrong version under the right tag name on npm,
which cannot be undone.

Add CHANGELOG.md, backfilled for 1.0.0-1.0.2 from the git history, and a
Releasing section in CONTRIBUTING.
---
 .github/workflows/release.yml | 58 +++++++++++++++++++++++++++++++++++
 CHANGELOG.md                  | 45 +++++++++++++++++++++++++++
 CONTRIBUTING.md               | 13 ++++++++
 3 files changed, 116 insertions(+)
 create mode 100644 .github/workflows/release.yml
 create mode 100644 CHANGELOG.md

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..fc6c568
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,58 @@
+name: Release
+
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    name: Publish to npm
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # create the GitHub Release
+      id-token: write # required for npm provenance
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # release notes need history
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          registry-url: https://registry.npmjs.org
+
+      - run: npm ci
+
+      # prepublishOnly runs these too, but running them here fails the job
+      # before anything is published rather than midway through.
+      - run: npm run lint
+      - run: npm run typecheck
+      - run: npm test
+      - run: npm run build
+
+      # A tag that disagrees with package.json would publish the wrong
+      # version under the right tag name, which cannot be undone.
+      - name: Verify the tag matches package.json
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          pkg="$(node -p "require('./package.json').version")"
+          if [ "$tag" != "$pkg" ]; then
+            echo "::error::tag v$tag does not match package.json version $pkg"
+            exit 1
+          fi
+
+      - run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Create the GitHub Release
+        if: startsWith(github.ref, 'refs/tags/')
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh release create "$GITHUB_REF_NAME" --generate-notes --verify-tag
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..3aeaaee
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,45 @@
+# Changelog
+
+All notable changes to this project are documented here.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## Unreleased
+
+### Fixed
+
+- Support the image editor `dock` and `corners` options in `Features` ([#25](https://github.com/unlayer/react-image-editor/issues/25))
+
+### Changed
+
+- Use the modern JSX transform
+
+### Internal
+
+- Full (100%) test coverage and additional edge-case scenarios
+
+## 1.0.2
+
+### Fixed
+
+- Contain exceptions thrown by a consumer's `onLoad` callback, so they can no longer surface as a wrapper failure ([#22](https://github.com/unlayer/react-image-editor/pull/22))
+
+### Added
+
+- Demo: image upload, so the demo can be tried with your own images
+
+## 1.0.1
+
+### Fixed
+
+- Contain exceptions thrown by a consumer's `onError` callback, which previously escaped as an unhandled promise rejection ([#9](https://github.com/unlayer/react-image-editor/issues/9))
+- Demo: auto-install demo dependencies in the root `dev` script, so a fresh clone works without a second `npm install` ([#8](https://github.com/unlayer/react-image-editor/issues/8))
+
+### Added
+
+- Demo: dark chrome for the top bar and sidebar
+
+## 1.0.0
+
+Initial release: the Unlayer Image Editor as a React component.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 701755e..db547f8 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -24,6 +24,19 @@
 - `npm run build` builds the component for publishing to npm.
 - `npm run build` in the `demo` directory builds the demo app.
 
+## Releasing
+
+Releases are published from CI, not from a maintainer's machine.
+
+1. Update `CHANGELOG.md`: rename `Unreleased` to the new version.
+2. Bump the version: `npm version <patch|minor|major>` (this creates the `vX.Y.Z` tag).
+3. `git push --follow-tags`.
+
+Pushing the tag runs `.github/workflows/release.yml`, which re-runs lint,
+typecheck, tests and build, verifies the tag matches `package.json`, publishes
+to npm with [provenance](https://docs.npmjs.com/generating-provenance-statements),
+and creates the GitHub Release. It needs an `NPM_TOKEN` repository secret.
+
 ## Conventions
 
 - Commit messages follow [Conventional Commits 1.0](https://www.conventionalcommits.org/en/v1.0.0/).