[tomasr78]

Moves convertapi-js to the trunk-based release flow of https://github.com/ConvertAPI/convertapi-library-dotnet and https://github.com/ConvertAPI/convertapi-library-node (PR ConvertAPI/convertapi-library-node#96).

Until now this repo had no workflows and npm versions were published by hand (publish.sh).

Pipeline

• build.yml: the TypeScript build, the unit tests and the live tests against staging run on Node 20, 22 and 24. They are aggregated into the required build check, and a 0.0.0-ci.{run}.g{sha} tarball is packed as an artifact. Actions are pinned to SHAs.
• publish.yml: runs on a GitHub Release v{semver} published by tomasr78. It checks the publisher and the re-run actor, that the tag is SemVer, that the tag matches the checkout, that the version is on main, and that npm has never had that version. It then sets the version from the tag, builds, tests, and runs npm publish --provenance through npm Trusted Publishing (OIDC) from the npm environment (v* tags only).
• Dist-tags keep today's behaviour: stable releases go to module, pre-releases to next, and latest stays on the non-module 1.0.8 (publish.sh said "Tag latest must be non module implementation"). RELEASING.md explains how to move latest deliberately.

Package

• package.json: the version is now a 0.0.0-local placeholder (publish.yml sets the real one from the tag). Adds the build/test scripts and a types entry. prepublishOnly refuses a local publish. repository now points at convertapi-library-js, which npm provenance needs.
• Tests (node:test): unit tests with a stubbed fetch, plus live tests (upload, convert, chaining, remote URL, invalid token) that are skipped when CONVERT_API_SECRET is not set. CI sets it from the CONVERTAPI_STAGING_TOKEN secret.
• The README's remote-file example pointed at a 404 URL. It now uses https://cdn.convertapi.com/cara/testfiles/presentation.pptx.
• RELEASING.md, CHANGELOG.md and Dependabot are added; package-lock.json is now committed.

No library code changes. The next release would be 1.1.10, published under the module dist-tag.

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

Production publishing requires human verification of npm trust settings, tag protections, and environment restrictions outside the diff.

1 open issue

• Reject leading-zero numeric prerelease identifiers · New

What changed in this PR

Moves the library to trunk-based CI and GitHub Release publishing without changing library code.

Changes:

• Adds multi-version builds, tests, and downloadable package artifacts.
• Automates npm publishing with provenance and preserves existing dist-tag behavior.
• Adds release documentation, dependency updates, and reproducible installs.

File	Description
test/​setup.js	Adds browser compatibility shim and fetch stubs.
test/​live.test.js	Tests live API conversions and authentication.
test/​convertapi.test.js	Adds unit tests for library behavior.
RELEASING.md	Documents release controls and dist-tags.
README.md	Updates repository links and example URL.
publish.sh	Removes manual publishing script.
package.json	Adds build/test scripts and release metadata.
package-lock.json	Locks build dependencies.
CHANGELOG.md	Records release history and pipeline changes.
.gitignore	Allows committing the lockfile.
.github/​workflows/​publish.yml	Publishes validated releases through npm Trusted Publishing.
.github/​workflows/​build.yml	Builds, tests, audits, and packs CI artifacts.
.github/​dependabot.yml	Configures weekly dependency updates.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The publishing concurrency configuration can cancel pending releases before they reach npm.

No open issues 🎉

1 previously missed issue

In code that hasn't changed since last review

Newer releases cancel pending publishes, leaving releases unpublished

.github/​workflows/​publish.yml:46

cancel-in-progress: false protects the running job, but the default concurrency queue retains only one pending job. If release A is publishing while B waits, publishing release C cancels B, leaving B's GitHub Release unpublished on npm unless someone manually reruns it. Add queue: max to retain up to 100 pending release jobs while keeping publishing serialized (GitHub documentation).

1 resolved since last review

• Reject leading-zero numeric prerelease identifiers

_{Review effort: Balanced}