From d3233a2277d237d3293d90feda17ed9d1c83a289 Mon Sep 17 00:00:00 2001
From: Haseeb Ahmad <haseeb.ahmad@mapbox.com>
Date: Thu, 18 Jun 2026 11:13:47 +0200
Subject: [PATCH 1/3] CLOUDPLAT-3162: add npm OIDC publish workflow

https://mapbox.atlassian.net/browse/CLOUDPLAT-3162
---
 .github/workflows/npm-release.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 .github/workflows/npm-release.yml

diff --git a/.github/workflows/npm-release.yml b/.github/workflows/npm-release.yml
new file mode 100644
index 0000000..5bd342e
--- /dev/null
+++ b/.github/workflows/npm-release.yml
@@ -0,0 +1,13 @@
+name: NPM release
+
+on:
+  workflow_dispatch:
+
+jobs:
+  npm-release:
+    uses: mapbox/gha-public/.github/workflows/workflow-npm-oidc-publish.yml@main
+    permissions:
+      id-token: write
+      contents: write
+    with:
+      create-github-release: true

From 52fcdc625bd280e971abb149f3840f0f30650386 Mon Sep 17 00:00:00 2001
From: Haseeb Ahmad <haseeb.ahmad@mapbox.com>
Date: Thu, 18 Jun 2026 12:05:39 +0200
Subject: [PATCH 2/3] CLOUDPLAT-3162: add CONTRIBUTING.md and bump version

https://mapbox.atlassian.net/browse/CLOUDPLAT-3162
---
 package.json | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 9ec8ff0..d4a3974 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@mapbox/magic-cfn-resources",
-  "version": "4.1.0",
+  "version": "4.1.1",
   "description": "Build Lambda-backed custom CloudFormation resources",
   "main": "index.js",
   "directories": {
@@ -32,5 +32,8 @@
   "dependencies": {
     "@mapbox/cloudfriend": "^8.4.0",
     "aws-sdk": "^2.1692.0"
+  },
+  "publishConfig": {
+    "access": "public"
   }
 }

From 0ff76436fbe16254f4b283a4be91f3561dc89bae Mon Sep 17 00:00:00 2001
From: Haseeb Ahmad <haseeb.ahmad@mapbox.com>
Date: Thu, 18 Jun 2026 12:11:42 +0200
Subject: [PATCH 3/3] CLOUDPLAT-3162: add CONTRIBUTING.md and bump version

https://mapbox.atlassian.net/browse/CLOUDPLAT-3162
---
 contributing.md | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/contributing.md b/contributing.md
index b14a8e9..a8bd9d0 100644
--- a/contributing.md
+++ b/contributing.md
@@ -76,3 +76,19 @@ Use [JSDoc style comments](http://usejsdoc.org/index.html) and build documentati
 - Try to write functions to have no external dependencies aside from the [AWS SDK for JS](http://docs.aws.amazon.com/AWSJavaScriptSDK/latest/index.html).
 - During the create event you must assign your backend resource a PhysicalResourceId. Make sure that this ID will be sufficient to identify the backend resource in a later update or delete event.
 - The update and delete events are particularly challenging. They may or may not be triggered after a resource was actually created, so it is not safe to assume that the resource already exists. Be sure to handle both scenarios or you may end up with a stack that you're unable to delete.
+
+## Releasing a new version
+
+Releases are published to npm via GitHub Actions.
+
+### Steps
+
+1. **Bump the version** in `package.json` (follow [semver](https://semver.org))
+2. **Update `CHANGELOG.md`** with a summary of what changed
+3. **Open a PR**, get it reviewed and merged to `master`
+4. **Trigger the release** from the [Actions tab](../../actions/workflows/npm-release.yml):
+   - Select **NPM release** → **Run workflow** → run from `master`
+
+The workflow will publish to npm and create a GitHub release with auto-generated notes.
+
+> **Note:** Only Mapbox maintainers with write access to this repository can trigger the release workflow. External contributors can open and contribute to PRs, but releases are always cut by the owning team.