ci: add release-prepare and release-publish workflows for npm releases

.github/workflows/README.md

@@ -5,8 +5,8 @@
 Workflows are organized into two roles:
 
 ```
-Orchestrators (e.g. ci.yml, release.yml)
-Jobs          (e.g. build.yml, unit-test.yml, publish-npm.yml)
+Orchestrators (ci.yml, release-prepare.yml, release-publish.yml)
+Jobs          (verify.yml)
 ```
 
 **Orchestrators** respond to events and coordinate work. They define _when_ and
@@ -19,32 +19,27 @@ care what triggered it.
 
 An orchestrator calls jobs via `workflow_call`.
 
-### Current example
+### Current examples
 
 ```
 ci.yml
-  |-- check.yml      (lint, format, typecheck, audit, secret scan)
-  |-- build.yml      (bundle, package, compile, smoke test)
-  `-- unit-test.yml  (tests on Linux, Windows, macOS)
-```
+  `-- verify.yml     (one job per platform: static checks on Linux, then bundle,
+                      package, compile, smoke test and unit tests)
 
-### Future examples
+release-prepare.yml (version bump, vended CDK pin, release PR)
 
-```
-release.yml
-  ├── unit-test.yml
-  ├── build.yml
-  └── publish-npm.yml
+release-publish.yml (npm publish and GitHub release when a release PR merges)
+  `-- verify.yml
 ```
 
-Jobs like `unit-test.yml` and `build.yml` appear in multiple orchestrators. This
-is the point — write once, compose freely.
+`verify.yml` appears in both orchestrators. This is the point — write once,
+compose freely.
 
 ## Naming Convention
 
-- **Orchestrators** are named for their purpose (e.g. `ci`, `release`).
+- **Orchestrators** are named for their purpose (e.g. `ci`, `release-publish`).
 - **Jobs** are named as verbs or noun-verb pairs describing the work
-  (e.g. `build`, `unit-test`, `publish-npm`).
+  (e.g. `verify`).
 
 ## Key Choices
 

.github/workflows/ci.yml

@@ -13,20 +13,8 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  check:
-    uses: ./.github/workflows/check.yml
-    permissions:
-      contents: read
-    with:
-      ref: ${{ github.event.pull_request.head.sha || github.sha }}
-  build:
-    uses: ./.github/workflows/build.yml
-    permissions:
-      contents: read
-    with:
-      ref: ${{ github.event.pull_request.head.sha || github.sha }}
-  unit-test:
-    uses: ./.github/workflows/unit-test.yml
+  verify:
+    uses: ./.github/workflows/verify.yml
     permissions:
       contents: read
     with:

.github/workflows/pr-automation.yml

@@ -171,7 +171,7 @@ jobs:
         id: tarball
         run: |
           bun pm pack --destination "$RUNNER_TEMP"
-          tarball="$(find "$RUNNER_TEMP" -maxdepth 1 -type f -name 'agentcore-*.tgz' -print -quit)"
+          tarball="$(find "$RUNNER_TEMP" -maxdepth 1 -type f -name 'aws-agentcore-*.tgz' -print -quit)"
           test -f "$tarball"
           echo "name=$(basename "$tarball")" >> "$GITHUB_OUTPUT"
           echo "path=$tarball" >> "$GITHUB_OUTPUT"

.github/workflows/release-prepare.yml

@@ -0,0 +1,73 @@
+# Opens the release PR: bumps package.json, refreshes the vended @aws/agentcore-cdk pin, and pushes
+# release/v<version>. Merging that PR is the release approval and triggers release-publish.yml.
+name: release-prepare
+on:
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: Semver component to release. Ignored while an rc series is open, which continues or graduates instead.
+        required: true
+        type: choice
+        options: [major, minor, patch]
+      channel:
+        description: rc publishes under the rc dist-tag, stable under latest
+        required: true
+        type: choice
+        options: [rc, stable]
+
+jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-tags: true
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@v2
+      - uses: actions/create-github-app-token@v3
+        id: app-token
+        with:
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
+      - name: Bump version
+        id: version
+        env:
+          BUMP: ${{ inputs.bump }}
+          CHANNEL: ${{ inputs.channel }}
+        run: |
+          set -euo pipefail
+          CURRENT=$(bun pm pkg get version | tr -d '"')
+          # 0.28.1 -> 1.0.0-rc.0 -> 1.0.0-rc.1 -> 1.0.0. Bun's own "major" would jump an rc to 2.0.0.
+          if [[ "$CURRENT" == *-rc.* ]]; then
+            INCREMENT=$([ "$CHANNEL" = rc ] && echo prerelease || echo "${CURRENT%%-*}")
+          else
+            INCREMENT=$([ "$CHANNEL" = rc ] && echo "pre$BUMP" || echo "$BUMP")
+          fi
+          TAG=$(bun pm version "$INCREMENT" --preid rc --no-git-tag-version)
+          if git rev-parse -q --verify "refs/tags/$TAG" >/dev/null; then
+            echo "::error::$TAG is already released"
+            exit 1
+          fi
+          echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
+
+      - run: bun scripts/sync-vended-cdk.ts
+
+      - name: Open release PR
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          set -euo pipefail
+          BRANCH="release/v$VERSION"
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git commit -am "chore(release): v$VERSION"
+          git push --force "https://x-access-token:$GH_TOKEN@github.com/$GITHUB_REPOSITORY.git" "HEAD:refs/heads/$BRANCH"
+
+          if [ -z "$(gh pr list --base "$GITHUB_REF_NAME" --head "$BRANCH" --json number --jq '.[0].number')" ]; then
+            gh pr create --base "$GITHUB_REF_NAME" --head "$BRANCH" --title "chore(release): v$VERSION" \
+              --body "Merging publishes \`@aws/agentcore@$VERSION\` to npm and creates the \`v$VERSION\` GitHub release with generated notes."
+          fi

.github/workflows/release-publish.yml

@@ -0,0 +1,94 @@
+# Publishes @aws/agentcore to npm and creates the GitHub release when a release PR from
+# release-prepare.yml merges. The version is whatever the merged package.json says.
+name: release-publish
+on:
+  pull_request:
+    types: [closed]
+    # TODO: switch to main once the refactor lands there.
+    branches: [refactor]
+
+jobs:
+  verify:
+    if: github.event.pull_request.merged && startsWith(github.head_ref, 'release/v')
+    uses: ./.github/workflows/verify.yml
+    permissions:
+      contents: read
+    with:
+      ref: ${{ github.event.pull_request.merge_commit_sha }}
+
+  publish:
+    needs: verify
+    # npm provenance is only issued from GitHub-hosted runners.
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+    env:
+      REF: ${{ github.event.pull_request.merge_commit_sha }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ env.REF }}
+          fetch-tags: true
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@v2
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 20.x
+          registry-url: https://registry.npmjs.org
+      - run: bun install --frozen-lockfile
+
+      - name: Resolve release
+        id: release
+        run: |
+          set -euo pipefail
+          VERSION=$(bun pm pkg get version | tr -d '"')
+          # rc notes span from the previous rc, stable notes from the previous stable. Only this
+          # workflow's tags count, main's v1.0.0-preview.N tags live in the same repo.
+          DIST_TAG=latest
+          SEMVER_FLAGS=()
+          if [[ "$VERSION" == *-rc.* ]]; then
+            DIST_TAG=rc
+            SEMVER_FLAGS=(--include-prerelease)
+          fi
+          PREVIOUS=$(git tag -l 'v*' | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?$' \
+            | xargs bunx semver "${SEMVER_FLAGS[@]}" --range "<$VERSION" | tail -1)
+          {
+            echo "version=$VERSION"
+            echo "dist_tag=$DIST_TAG"
+            echo "previous_tag=v$PREVIOUS"
+          } >> "$GITHUB_OUTPUT"
+
+      - run: bun run build
+      - id: pack
+        run: echo "tarball=$(bun pm pack --quiet --ignore-scripts)" >> "$GITHUB_OUTPUT"
+      - run: bun run compile
+
+      - env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          VERSION: ${{ steps.release.outputs.version }}
+          DIST_TAG: ${{ steps.release.outputs.dist_tag }}
+          TARBALL: ${{ steps.pack.outputs.tarball }}
+        # A rerun after a failed release step must not republish, npm rejects an existing version.
+        run: |
+          if npm view "@aws/agentcore@$VERSION" version >/dev/null 2>&1; then
+            echo "@aws/agentcore@$VERSION is already on npm, skipping publish"
+          else
+            npm publish "$TARBALL" --provenance --access public --tag "$DIST_TAG"
+          fi
+
+      - env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ steps.release.outputs.version }}
+          PREVIOUS_TAG: ${{ steps.release.outputs.previous_tag }}
+          TARBALL: ${{ steps.pack.outputs.tarball }}
+        # A rerun after a failed asset upload re-uploads into the existing release instead of failing on the tag.
+        run: |
+          if gh release view "v$VERSION" >/dev/null 2>&1; then
+            gh release upload "v$VERSION" --clobber "$TARBALL" dist/bin/*
+          else
+            gh release create "v$VERSION" --target "$REF" --title "v$VERSION" \
+              --generate-notes --notes-start-tag "$PREVIOUS_TAG" \
+              ${{ steps.release.outputs.dist_tag == 'rc' && '--prerelease' || '--latest' }} \
+              "$TARBALL" dist/bin/*
+          fi