[tomasr78]

Moves the npm package convertapi to the same trunk-based release flow as convertapi-library-dotnet (see its RELEASING.md).

master has already been renamed to main. Open pull requests were retargeted automatically.

Build (build.yml, replaces main.yml)

• Runs on every pull request to main, every push to main, and on demand.
• Lints, tests and builds on Node.js 20, 22 and 24 (was 16/18/20/21), then runs the examples.
• Audits the runtime dependencies: a high or critical advisory fails the build. Dev dependencies are not audited because they are not shipped.
• Packs a 0.0.0-ci.{run}.g{sha} artifact.
• The required check is the final job build. It fails if any Node version failed, so a skipped check can never count as passed.
• The tests used secrets.CONVERTAPI_SECRET, which didn't exist, so every run failed with 401. They now run against staging (https://stag-v2.convertapi.com/) with the new CONVERTAPI_STAGING_TOKEN secret, which is also set for Dependabot. test/index.js reads CONVERT_API_BASE_URI.
• Actions are pinned to commit SHAs, and checkout uses persist-credentials: false.

Publish (publish.yml)

• Triggered by release: published. Only tomasr78 may publish or re-run it, the same check as in .NET.
• Checks that the tag is SemVer, that the pre-release tick matches the version, that a stable tag is on main, and that the version has never existed on npm.
• Sets the version from the tag (npm version --no-git-tag-version), then audits, tests, builds and checks the tarball.
• Runs npm publish --provenance from the npm environment. Dist-tags: latest, next for pre-releases, maintenance for backports.
• Authenticates with npm Trusted Publishing (OIDC) when vars.NPM_TRUSTED_PUBLISHING == 'true', otherwise with the NPM_TOKEN secret.
• No lifecycle scripts run in the publishing job, and there is no dependency cache.

Package

• package.json now holds the placeholder version 0.0.0-local. Its repository, bugs and homepage URLs now point at convertapi-library-node, which npm provenance requires.
• prepublish, which ran lint, tests and build on every npm install/npm ci, is replaced by a prepublishOnly that refuses a local npm publish.
• axios ^1.6.2 → ^1.20.0. This closes the high and critical advisories in axios, form-data and follow-redirects.
• Added RELEASING.md, CHANGELOG.md (1.15.1 prepared) and weekly Dependabot (npm + github-actions). The README links point at the renamed repository.

After merge: the main and v* tag rulesets, the npm environment (v* tags only), then the release v1.15.1.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Examples ignore the staging host configuration, and artifact naming causes successful workflow reruns to fail.

2 open issues

• Example clients ignore staging API base URI · New
• Artifact upload fails when rerunning a successful workflow · New

What changed in this PR

Moves convertapi to trunk-based development with required CI checks and npm publishing through GitHub Releases.

Changes:

• Adds a Node.js 20/22/24 build matrix, dependency auditing, and CI artifacts.
• Adds release validation, provenance, and configurable npm authentication.
• Updates dependencies, staging test configuration, and release documentation.

File	Description
test/​index.js	Supports a configurable API host.
RELEASING.md	Documents the release process.
README.md	Updates repository links and development guidance.
package.json	Updates dependencies, metadata, and publishing hooks.
package-lock.json	Locks updated runtime dependencies.
CHANGELOG.md	Records release history and prepared changes.
.github/​workflows/​publish.yml	Adds validated GitHub Release publishing.
.github/​workflows/​main.yml	Removes the previous build workflow.
.github/​workflows/​build.yml	Adds matrix validation and package artifacts.
.github/​dependabot.yml	Schedules weekly dependency updates.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The example failure check can miss caught native errors, allowing the required build to pass despite a failed example.

1 open issue

• Artifact upload fails when rerunning a successful workflow

1 resolved since last review

• Example clients ignore staging API base URI

_{Review effort: Balanced}