[kamal-kaur04]

Problem

browserstack-local is published to npm from a developer machine with an npm access token. npm is removing token-based publishing in January 2027. Its replacement, trusted publishing, only accepts a publish from a CI workflow registered on the package.

Change

Adds .github/workflows/publish.yml (Local Binding Publish), which runs the existing release steps in GitHub Actions.

To release: Actions → Local Binding Publish → Run workflow on master → pick the Version Type: patch, minor, major or prerelease.

Release step	Workflow
npm version <type>	npm version <type> (commit + tag v<version>)
npm login with a token	not needed: npm gives this workflow a one-time credential
npm publish --access public	npm publish --access public
git push --follow-tags	git push --follow-tags to a new release-<timestamp> branch instead of master. The run summary links to open the version bump PR into master

The bump goes to a branch because master only accepts changes through pull requests. Merge the bump PR before the next release: if master still has the old version, npm version stops with "tag already exists" and nothing is published.

prerelease is for test releases: it publishes <next>-tp.0 (e.g. 1.5.17-tp.0) to the next dist-tag and pushes only its tag, so latest and master are untouched. Prereleases are never picked by npm i browserstack-local or ^/~ ranges.

The tag and branch are pushed only after the publish succeeds, so a failed publish can simply be re-run. Because the repo is public, npm also attaches provenance to each version.

Nothing runs until someone dispatches it, and nothing can publish until this workflow is added as the trusted publisher on npmjs.com.

Tests

• actionlint clean. Actions pinned to commit SHAs, and npm pinned to 11.21.0.
• Dry run of the steps against a clone of this repo, with real git commit and tag. npm publish and git push were logging stubs:

Case	Result
patch / minor / major from 1.5.16	1.5.17 / 1.6.0 / 2.0.0 to latest → tag + release-<timestamp> branch
prerelease from 1.5.16	1.5.17-tp.0 to next → tag v1.5.17-tp.0 only
previous bump PR not merged (tag exists)	stops at npm version, nothing published
npm publish fails	stops; no tag or branch pushed

• A clean checkout of v1.5.16 packs the same 21 files, byte-identical, as the published browserstack-local@1.5.16, so a CI publish ships the same package.

After merge

1. Add this workflow as the trusted publisher on npmjs.com: browserstack / browserstack-local-nodejs / publish.yml.
2. Test with prerelease, then release with patch / minor / major.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML (base), Organization UI (inherited), Workspace UI (inherited); Enforced overrides: Organization
• Review profile: ASSERTIVE
• Plan: Enterprise
• Run ID: b376d575-8054-4587-b2cb-caba2c1c567b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts