From a74e154a02a6077647fd5aa354505216222c92da Mon Sep 17 00:00:00 2001
From: Alex Gusev <alex.gusev@uploadcare.com>
Date: Tue, 9 Jun 2026 15:34:36 +0600
Subject: [PATCH] ci: migrate npm publish to staged publishing

---
 .github/workflows/shipjs-trigger.yml | 24 +++++++++++++++++++++---
 ship.config.js                       |  3 +--
 2 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/shipjs-trigger.yml b/.github/workflows/shipjs-trigger.yml
index 86adc17..aa546ce 100644
--- a/.github/workflows/shipjs-trigger.yml
+++ b/.github/workflows/shipjs-trigger.yml
@@ -9,17 +9,35 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.pull_request.merged == true && startsWith(github.head_ref, 'releases/v')
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
           ref: main
-      - uses: actions/setup-node@v2
+      - uses: actions/setup-node@v4
         with:
           registry-url: "https://registry.npmjs.org"
-          node-version: '16'
+          node-version: '24'
+      - name: Pin npm with staged publishing support
+        run: npm install -g npm@">=11.15.0"
       - run: yarn install --frozen-lockfile
       - run: npx shipjs trigger
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NPM_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
           SLACK_INCOMING_HOOK: ${{ secrets.SLACK_INCOMING_HOOK }}
+      - name: Read package metadata
+        id: pkg
+        run: |
+          {
+            echo "name=$(node -p "require('./package.json').name")"
+            echo "version=$(node -p "require('./package.json').version")"
+          } >> "$GITHUB_OUTPUT"
+      - name: Notify Slack about staged release
+        uses: slackapi/slack-github-action@37ebaef184d7626c5f204ab8d3baff4262dd30f0 # v1.27.0
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        with:
+          channel-id: ${{ secrets.SLACK_NPM_RELEASE_CHANNEL }}
+          slack-message: |
+            :package: *${{ steps.pkg.outputs.name }}@${{ steps.pkg.outputs.version }}* staged for review
+            Review & approve (2FA required): https://www.npmjs.com/package/${{ steps.pkg.outputs.name }}?activeTab=staged
diff --git a/ship.config.js b/ship.config.js
index b94029e..14c2c1e 100644
--- a/ship.config.js
+++ b/ship.config.js
@@ -1,4 +1,3 @@
 module.exports = {
-  publishCommand: ({ defaultCommand, tag }) =>
-    `${defaultCommand} --access public --tag ${tag}`
+  publishCommand: ({ tag }) => `npm stage publish --tag ${tag}`
 };