From fccaa4ba9cf875953826c58fc21f860e17ed2e32 Mon Sep 17 00:00:00 2001
From: Jason Marshall <jdmarshall@users.noreply.github.com>
Date: Wed, 15 Jul 2026 10:32:46 -0700
Subject: [PATCH] Add publication workflow for npmjs.com

Signed-off-by: Jason Marshall <jdmarshall@users.noreply.github.com>
---
 .github/workflows/release.yml | 44 +++++++++++++++++++++++++++++++++++
 .npmrc                        |  3 +++
 package.json                  |  2 +-
 3 files changed, 48 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 00000000..5765d1ae
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,44 @@
+---
+name: Publish to npmjs.com
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag to publish (e.g. v1.5.1)'
+        required: true
+
+permissions: {}
+
+jobs:
+  publish:
+    environment: release
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write # required to trigger bump-api-diff-baseline.yml via `gh workflow run`
+
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Use Node.js 26
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 26.x
+      - name: Verify release secrets
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          fail() {
+            echo "::error::$1"
+            echo "::error::Fix: see '$2' in RELEASING.md"
+            exit 1
+          }
+
+          # NPM token check
+          if [ -z "${NPM_TOKEN}" ]; then
+            fail "No secret key available after import." \
+          fi
+
+      - run: npm i
+      - run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.npmrc b/.npmrc
index 43c97e71..7f3eb915 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1 +1,4 @@
 package-lock=false
+min-release-age=2
+registry=https://registry.npmjs.org/
+always-auth=true
diff --git a/package.json b/package.json
index 5addbc4c..e8b21caa 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@prometheus/client",
-	"version": "15.1.3",
+	"version": "0.16.0-alpha.0",
 	"description": "Client for prometheus",
 	"main": "index.js",
 	"files": [