[Puppo]

Adds a manually dispatched release workflow with patch, minor, and major choices, enabling approval-gated npm trusted publishing through the shared Fastify workflow.

The caller grants id-token: write and contents: write only to the release job and pins fastify/workflows/.github/workflows/reusable-release.yml to b1a11bce713bc857e52b2231fec3c89071ad3135. The shared workflow uses the release environment, commits/pushes the version bump, publishes to npm with provenance, and creates the GitHub Release. This JavaScript package needs no release build step.

Follows fastify/accept-negotiator#77 as one of two pilot migration drafts.

Validation

Local validation with Node.js 24.21.0 and npm 11.19.0:

• npm install --ignore-scripts --no-audit --no-fund
• npm run lint
• npm test: 10 runtime tests passed with 100% coverage; 39 type assertions passed.
• Actionlint 1.7.12 passed for the new workflow; verified dispatch choices, permissions, pinned reusable-workflow input compatibility, and the inherited release environment.
• npm pack: inspected the tarball and verified index.js, types/index.d.ts, and unchanged package version 5.0.6.

Admin setup before the first release

These settings are not changed by this PR and remain unverified:

• Configure the release environment with required reviewer team fastify/release and deployment access exclusively for branch main (check for extra branch/tag policies).
• Confirm branch protection/rulesets allow the reusable workflow to push the version commit using GITHUB_TOKEN.
• Configure the npm GitHub Actions Trusted Publisher: label manual-gha-release, organization fastify, repository fastify-accepts, workflow filename release.yml, environment release, Allow publish enabled.
• After review, setup, and merge, validate one real release: approval gate and reviewer notifications, npm package contents/provenance, version commit, tag, and GitHub Release. Use a manual Discord notification if GitHub notifications prove insufficient.

No version bump, npm publication, release dispatch, or administrative settings/access changes were performed while preparing this draft.