Automate Release Process + Provenance
Is your feature request related to a problem? Please describe. No
Describe the solution you'd like By automating the release process, it will eliminate risk that the release process won't be followed and the release.md doc can be automated. (see this workflow as an example of what could be implemented for automation).
It also introduces support for NPM provenance. Provenance is a system in NPM that attests the build process and ensures that what you see is what you get, by process reducing risk via proving that an un-known actor is unable to execute in the shadows. Attestation is a way to prove package health via correlation of published package to GH Actions publish command execution via cryptography.
By shifting the release process from local computers to a GH Actions instance, it also reduces risk from a threat actor or malware that is present on the machine that is publishing.
Describe alternatives you've considered Keeping everything the same?
Additional context NPM Docs: https://docs.npmjs.com/generating-provenance-statements
Source: sinonjs/sinon