Twilio Node SDK — Release Plan

ci.yml (CI)

Triggers: PRs to main | Push to main | Manual dispatch | Cron (Monday 9AM IST)

Jobs

1. lockfile-hygiene (all triggers)

   • Checkout
   • npm-lockfile-hygiene — fails if internal Artifactory hosts found in lockfile

2. test (Node matrix) — needs: lockfile-hygiene (all triggers)

   • Checkout
   • Artifactory OIDC Auth
   • Setup Node + cache
   • npm ci
   • npm run ci (unit tests + security check + formatting check)
   • npm run build
   • Cluster tests (pack → install → run integration tests against live Twilio APIs)
   • Matrix: lts/* on PRs/pushes, [22, 24] on cron/manual with all

3. deploy-dry-run (Release Readiness Check - Build artifact) — needs: test (cron + manual dispatch only)

   • Checkout
   • Artifactory OIDC Auth
   • Setup Node 24
   • npm ci
   • npm run build
   • npm pack (creates tarball locally)
   • Print summary (version, artifact size)
   • Does NOT publish

---

deploy.yml — Publish to npm

Trigger: Tag push matching v*

How to release

1. Bump version in package.json, merge to main
2. Tag and push: git tag v6.0.3 && git push --tags
3. Workflow fires automatically
4. Approve the production environment gate when prompted
5. Verify: npm view [email protected] + check provenance badge on npmjs.org

Jobs

1. test (Node 22, 24 matrix)

   • Checkout
   • Artifactory OIDC Auth
   • Setup Node + cache
   • npm ci
   • npm test
   • npm run build

2. deploy (Publish to npm) — needs: test, requires production env approval

   • Checkout
   • Artifactory OIDC Auth
   • Setup Node 24
   • Create GitHub Release (auto-generated notes)
   • npm ci
   • npm run build
   • Validate tag matches package.json version
   • Publish to registry.npmjs.org (OIDC, --provenance, --access public)
   • Prerelease tag (e.g. v1.2.3-rc.1) → next dist-tag
   • Stable tag (e.g. v1.2.3) → latest dist-tag

---

End-to-end Release Day Flow

Step	Action
Weekly	Monday cron runs CI workflow — confirms infra is healthy (full matrix + dry run)
On every PR	CI workflow runs lockfile-hygiene + test (lts/*) + cluster tests
1	[ Librarian ] PR: bump package.json version, merge to main
2	[ Librarian ] git tag vX.Y.Z && git push --tags
3	deploy.yml fires automatically on tag creation, tests run (Node 22 + 24)
4	[ Manual ] Approve production environment gate
5	GitHub Release created, package published to npm with provenance
6	[ Manual ] Verify: npm view [email protected] + provenance badge on npmjs.org

---

Platform Team Dependencies

Dependency	Owner	Breaks if...
Artifactory OIDC provider (github-actions)	SSC / Platform	Repo renamed, org changed, trust not configured
vars.ARTIFACTORY_URL	Repo admin	Variable not set or URL changes
virtual-npm-thirdparty Artifactory repo	SSC / Artifactory admin	Repo missing, packages not proxied
production GitHub environment	Repo admin	Environment doesn't exist or approvals misconfigured
ubuntu-x64 runner group	Enterprise admin	Repo not added to runner group, or runner pool down
npm trusted publisher	npm org admin	Not registered, or workflow filename / environment mismatch