unlayer · ivoIturrieta · Aug 15, 2026 · Aug 16, 2026 · Aug 16, 2026 · Aug 16, 2026
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
@@ -6,7 +6,7 @@
   "features": {
     "ghcr.io/devcontainers/features/node:1": {}
   },
-  "postCreateCommand": "yarn install",
+  "postCreateCommand": "corepack pnpm install --frozen-lockfile",
   "customizations": {
     "vscode": {
       "extensions": ["esbenp.prettier-vscode"]

diff --git a/.github/actions/verify-sdk/action.yml b/.github/actions/verify-sdk/action.yml
@@ -0,0 +1,19 @@
+name: Verify and pack SDK
+description: Verify the SDK package and create the registry tarball
+
+runs:
+  using: composite
+  steps:
+    - name: Bootstrap
+      shell: bash
+      run: ./scripts/bootstrap --frozen-lockfile
+
+    - name: Verify SDK package
+      shell: bash
+      run: pnpm test
+
+    - name: Pack verified SDK
+      shell: bash
+      run: |
+        mkdir sdk-package
+        npm pack --silent --pack-destination sdk-package ./dist
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -1,88 +1,64 @@
 name: CI
 on:
   push:
-    branches-ignore:
-      - 'generated'
-      - 'codegen/**'
-      - 'integrated/**'
-      - 'stl-preview-head/**'
-      - 'stl-preview-base/**'
+    branches:
+      - main
   pull_request:
-    branches-ignore:
-      - 'stl-preview-head/**'
-      - 'stl-preview-base/**'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
-  lint:
+  verify:
     timeout-minutes: 10
-    name: lint
-    runs-on: ${{ github.repository == 'stainless-sdks/unlayer-typescript' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
-    if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
+    name: verify (Node 24)
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
 
-      - name: Set up Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-
-      - name: Bootstrap
-        run: ./scripts/bootstrap
-
-      - name: Check types
-        run: ./scripts/lint
-
-  build:
-    timeout-minutes: 5
-    name: build
-    runs-on: ${{ github.repository == 'stainless-sdks/unlayer-typescript' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
-    if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - uses: actions/checkout@v6
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v6
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version: '24'
+          cache: 'pnpm'
 
-      - name: Bootstrap
-        run: ./scripts/bootstrap
+      - name: Verify and pack SDK
+        uses: ./.github/actions/verify-sdk
 
-      - name: Check build
-        run: ./scripts/build
-
-      - name: Get GitHub OIDC Token
-        if: github.repository == 'stainless-sdks/unlayer-typescript'
-        id: github-oidc
-        uses: actions/github-script@v8
+      - name: Upload verified SDK
+        uses: actions/upload-artifact@v4
         with:
-          script: core.setOutput('github_token', await core.getIDToken());
+          name: sdk-package
+          path: sdk-package/*.tgz
+          retention-days: 1
 
-      - name: Upload tarball
-        if: github.repository == 'stainless-sdks/unlayer-typescript'
-        env:
-          URL: https://pkg.stainless.com/s
-          AUTH: ${{ steps.github-oidc.outputs.github_token }}
-          SHA: ${{ github.sha }}
-        run: ./scripts/utils/upload-artifact.sh
-  test:
-    timeout-minutes: 10
-    name: test
-    runs-on: ${{ github.repository == 'stainless-sdks/unlayer-typescript' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
-    if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
+  runtime:
+    timeout-minutes: 5
+    name: runtime (Node 20)
+    needs: verify
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '20'
+          package-manager-cache: false
 
-      - name: Bootstrap
-        run: ./scripts/bootstrap
+      - name: Download verified SDK
+        uses: actions/download-artifact@v4
+        with:
+          name: sdk-package
+          path: sdk-package
 
-      - name: Run tests
-        run: ./scripts/test
+      - name: Verify packed SDK runtime
+        run: ./scripts/test-package-archive sdk-package/*.tgz tests/packed-sdk-smoke.mjs
diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
@@ -1,32 +1,88 @@
-# This workflow is triggered when a GitHub release is created.
-# It can also be run manually to re-publish to NPM in case it failed for some reason.
-# You can run this workflow by navigating to https://www.github.com/unlayer/unlayer-typescript/actions/workflows/publish-npm.yml
+# Dispatched at the release tag after Release Please creates a GitHub release.
+# It can also be run manually at that tag to retry a failed publish.
 name: Publish NPM
 on:
   workflow_dispatch:
 
-  release:
-    types: [published]
+permissions:
+  contents: read
 
 jobs:
-  publish:
-    name: publish
+  verify:
+    timeout-minutes: 10
+    name: verify (Node 24)
     runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
 
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v6
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          cache: 'pnpm'
+
+      - name: Verify release tag
+        run: bash ./bin/check-release-ref
+
+      - name: Verify and pack SDK
+        uses: ./.github/actions/verify-sdk
+
+      - name: Upload verified SDK
+        uses: actions/upload-artifact@v4
+        with:
+          name: sdk-package
+          path: sdk-package/*.tgz
+          retention-days: 1
+
+  runtime:
+    timeout-minutes: 5
+    name: runtime (Node 20)
+    needs: verify
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
 
       - name: Set up Node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v6
         with:
           node-version: '20'
+          package-manager-cache: false
 
-      - name: Install dependencies
-        run: |
-          yarn install
+      - name: Download verified SDK
+        uses: actions/download-artifact@v4
+        with:
+          name: sdk-package
+          path: sdk-package
+
+      - name: Verify packed SDK runtime
+        run: ./scripts/test-package-archive sdk-package/*.tgz tests/packed-sdk-smoke.mjs
+
+  publish:
+    timeout-minutes: 5
+    name: publish
+    needs: runtime
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          package-manager-cache: false
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Download verified SDK
+        uses: actions/download-artifact@v4
+        with:
+          name: sdk-package
+          path: sdk-package
 
       - name: Publish to NPM
-        run: |
-          bash ./bin/publish-npm
-        env:
-          NPM_TOKEN: ${{ secrets.UNLAYER_NPM_TOKEN || secrets.NPM_TOKEN }}
+        run: bash ./bin/publish-npm sdk-package/*.tgz
diff --git a/.github/workflows/release-doctor.yml b/.github/workflows/release-doctor.yml
@@ -5,18 +5,23 @@ on:
       - main
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   release_doctor:
     name: release doctor
     runs-on: ubuntu-latest
-    if: github.repository == 'unlayer/unlayer-typescript' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release-please') || github.head_ref == 'next')
+    if: github.repository == 'unlayer/unlayer-typescript' && (github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release-please') || github.head_ref == 'next')
 
     steps:
       - uses: actions/checkout@v6
 
-      - name: Check release environment
-        run: |
-          bash ./bin/check-release-environment
-        env:
-          NPM_TOKEN: ${{ secrets.UNLAYER_NPM_TOKEN || secrets.NPM_TOKEN }}
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          package-manager-cache: false
 
+      - name: Check release environment
+        run: bash ./bin/check-release-environment
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -0,0 +1,43 @@
+name: Release
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  actions: write
+  contents: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    name: release please
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Create or update release
+        id: release
+        uses: googleapis/release-please-action@v5
+        with:
+          token: ${{ github.token }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+
+      - name: Run CI for the release PR
+        if: steps.release.outputs.prs_created == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_PR: ${{ steps.release.outputs.pr }}
+        run: |
+          branch=$(node -e "process.stdout.write(JSON.parse(process.env.RELEASE_PR).headBranchName)")
+          test -n "$branch"
+          gh workflow run ci.yml --ref "$branch"
+
+      - name: Publish the created release
+        if: steps.release.outputs.release_created == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ steps.release.outputs.tag_name }}
+        run: gh workflow run publish-npm.yml --ref "$RELEASE_TAG"