From f0ba9e721a990449ab7107681e1f95159cada495 Mon Sep 17 00:00:00 2001
From: Pablo Abella <pablo.abella@tinybird.co>
Date: Fri, 9 Oct 2026 11:38:00 +0200
Subject: [PATCH] Add the SDK release workflow and repository policies

Pushing an analytics-v* tag now publishes @rawtree/analytics to npm with
provenance, after checking the tag matches the package version and the
tests pass. CONTRIBUTING.md explains the release steps. SECURITY.md asks
for private vulnerability reports, and CODEOWNERS requests review from
the RawTree engineering team.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .github/CODEOWNERS                |  4 +--
 .github/workflows/release-sdk.yml | 48 +++++++++++++++++++++++++++++++
 CONTRIBUTING.md                   | 10 +++++++
 SECURITY.md                       | 11 +++++++
 4 files changed, 71 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/release-sdk.yml
 create mode 100644 SECURITY.md

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index ecf80dd..abc258a 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,2 +1,2 @@
-# Request review from the default repository maintainer.
-* @pei-tinybird
+# Pull requests need a review from the RawTree engineering team.
+* @rawtreedb/engineering
diff --git a/.github/workflows/release-sdk.yml b/.github/workflows/release-sdk.yml
new file mode 100644
index 0000000..119f4bd
--- /dev/null
+++ b/.github/workflows/release-sdk.yml
@@ -0,0 +1,48 @@
+name: Release SDK
+
+# Publishes @rawtree/analytics to npm when a tag like `analytics-v0.1.0` is pushed.
+# The tag must match packages/analytics/package.json. Auth uses npm trusted publishing
+# (OIDC, no stored token) once it's configured for this workflow on npmjs.com; an
+# NPM_TOKEN repository secret works as a fallback.
+
+on:
+  push:
+    tags: ["analytics-v*"]
+
+permissions:
+  contents: read
+  id-token: write # npm trusted publishing and provenance
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+          registry-url: https://registry.npmjs.org
+
+      - name: Use an npm that supports trusted publishing
+        run: npm install -g npm@^11.5.1
+
+      - name: Check the tag matches the package version
+        run: |
+          expected="analytics-v$(node -p 'require("./packages/analytics/package.json").version')"
+          if [ "$GITHUB_REF_NAME" != "$expected" ]; then
+            echo "Tag $GITHUB_REF_NAME does not match $expected" >&2
+            exit 1
+          fi
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Test
+        run: npm test
+
+      - name: Publish
+        run: npm publish -w @rawtree/analytics --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 264376c..7df8357 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -38,6 +38,16 @@ CI runs the same three checks on every pull request. Every pull request also get
 
 [AGENTS.md](AGENTS.md) has the same rules in more detail, for people and coding agents.
 
+## Releasing the SDK (maintainers)
+
+`@rawtree/analytics` is published to npm by the [Release SDK](.github/workflows/release-sdk.yml) workflow, with provenance.
+
+1. Bump `version` in `packages/analytics/package.json` in a pull request (semver: breaking changes to the event contract or the public API need a major version once we're past 0.x) and merge it.
+2. Tag the merge commit and push the tag: `git tag analytics-v0.2.0 && git push origin analytics-v0.2.0`.
+3. The workflow checks that the tag matches the version, runs the tests, and publishes.
+
+One-time setup: an npm account with publish rights on the `@rawtree` scope, and on npmjs.com a trusted publisher for this repository and the `release-sdk.yml` workflow (or an `NPM_TOKEN` repository secret). Provenance requires the repository to be public.
+
 ## License
 
 By contributing, you agree that your contributions are licensed under the [Apache License 2.0](LICENSE).
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..294d8c1
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,11 @@
+# Security policy
+
+## Reporting a vulnerability
+
+Please don't open a public issue for security problems. Report them privately through GitHub: on this repository's **Security** tab, choose **Report a vulnerability**. We'll acknowledge the report and keep you updated while we fix it.
+
+Include what's affected (the SDK, the collector, the dashboard, sign-in, or the console), how to reproduce it, and the impact you see. Never include real API keys, tokens, or other people's data.
+
+## Supported versions
+
+Security fixes go into the latest release of `@rawtree/analytics` and the `main` branch.