[Puppo]

Summary

Adds a maintainer-gated release pipeline using
nearform-actions/optic-release-automation-action
(modelled on the workflow used by
nearform/fastify-mssql).

What it does

• Triggers manually via workflow_dispatch (semver choice: patch / minor / major) and on pull_request: closed for the publish step.
• Version bump is delegated to the existing standard-version release script via bump-command, so CHANGELOG.md generation is preserved.
• Publishes to npm via Trusted Publishing (publish-mode: oidc, no NPM_TOKEN secret required).
• Notifies issues referenced via Fixes #N in the included PRs (notify-linked-issues: 'true').

Maintainer-only enforcement

• The job runs against the production GitHub environment, which must be configured (one time) with the maintainer as a required reviewer in Settings → Environments → production. This is the only gate that prevents non-maintainers from running the release.
• npm Trusted Publisher must also be linked (one time) at https://www.npmjs.com/package/@thecodepace/fastify-http-query/access: GitHub Actions, repo TheCodePace/fastify-http-query, workflow release.yml, environment production.

If Trusted Publishing is not desired, the maintainer can switch publish-mode to token and add an NPM_TOKEN secret instead.

Files changed

• .github/workflows/release.yml (new) — 33 lines

Verification

1. After merge, the maintainer configures the production environment and the npm Trusted Publisher.
2. As maintainer, run Actions → release → Run workflow → patch. The action pushes a release/v* branch and opens a PR with the package.json bump and CHANGELOG.md update.
3. Merge the release PR. The action publishes to npm, creates the GitHub Release, and comments on linked issues.
4. As a non-maintainer, attempt to dispatch the workflow — GitHub should reject the run with "Review required".

Checklist

• Create the production environment with the maintainer as required reviewer
• Link the npm Trusted Publisher (or add NPM_TOKEN + switch to publish-mode: token)
• (First release) Run npm run release:first locally, or let the action handle the 0.0.0 → 0.0.1 bump