Check for package.json and that version there matches rc. (#323)

* Check for package.json and that version there matches rc.

* Update npm related docs.
diff --git a/docs/release_instructions.md b/docs/release_instructions.md
index 08af448..c5ee90e 100644
--- a/docs/release_instructions.md
+++ b/docs/release_instructions.md
@@ -114,12 +114,19 @@
      - repository: URL of the repository
      - branch: git branch being released (`master` or a release branch name)
 
+**Important Note:** If you are releasing a Node.js package which
+contains a `package.json`, you should make sure the `version`
+specified in `package.json` matches your release version. If you
+also have a `package-lock.json` file, it too must have a matching
+`version` property. See additional tips for [releasing npm
+packages](#publishing-to-npm).
+
 ### Create Release Candidates
 
 From the [tools directory](../tools), execute the script
 [build_release.sh](../tools/build_release.sh)
 providing the config.json file as an argument.
-Using ../stagingArea as scratch space, this script will clone the
+Using `../stagingArea` as scratch space, this script will clone the
 source repositories, package them into compressed tarballs, and create
 the checksum and detached PGP signature files.
 ```
@@ -283,6 +290,16 @@
 credentials found in the npmjs.txt file in the accounts subdir of the
 PMC private svn.
 
+Some tips:
+* Login as the openwhisk-bot using `npm login`.
+* The `version` specified in `package.json` (and `package-lock.json`
+if it exists) should match the release version. If they don't you need
+to fix the release.
+* Confirm that `npm pack` does not report any errors. Then delete the
+generated `.tgz` file.
+* Confirm the list of files that will bundled using `npm publish --dry-run`.
+* To publish the distribution, use `npm publish --public`.
+
 If you are releasing a new version of the openwhisk-client-js package,
 then after the new version of the `openwhisk` package is published on
 npm, submit PRs to update the version number for the openwhisk package
diff --git a/tools/rcverify.sh b/tools/rcverify.sh
index 258af95..7281480 100755
--- a/tools/rcverify.sh
+++ b/tools/rcverify.sh
@@ -115,6 +115,26 @@
   fi
 }
 
+## checks if the rc has a pakage.json file containing a version field matching the rc
+## the first parameter is a path to the file to check e.g., package.json or package-lock.json
+## the second parameter is the version to confirm
+function packageJsonCheckVersion() {
+    PJSON=$1
+    EXPECTED_VERSION=$2
+
+    if [ -f "$PJSON" ]; then
+        JQ=$(command -v jq)
+        if [ "$JQ" != "" ]; then
+            PKG_VERSION=$(cat "$PJSON" | $JQ -r .version)
+            validate "$PKG_VERSION" "$EXPECTED_VERSION" "expected $EXPECTED_VERSION in '$PJSON'."
+        else
+            validate 0 1 "jq not found, check that version in '$PJSON' is $EXPECTED_VERSION."
+        fi
+    else
+        validate 0 0 "" "none detected"
+    fi
+}
+
 echo "unpacking tar ball"
 tar zxf "$DIR/$TGZ" -C "$DIR"
 
@@ -161,7 +181,7 @@
 validate $? 0 "$CMD"
 
 printf "verifying sources have proper headers..."
-if [ -f '$DIR/$BASE/tools/travis/scancodeExlusions' ]; then
+if [ -f "$DIR/$BASE/tools/travis/scancodeExlusions" ]; then
     SCANCODE_EXTRA_ARGS="--gitignore '$DIR/$BASE/tools/travis/scancodeExclusions'"
 else
     SCANCODE_EXTRA_ARGS=""
@@ -186,6 +206,12 @@
 EXE=$(find "$DIR/$BASE" -type d -name "node_modules" -o -name ".gradle")
 validate "$EXE" "" "$EXE"
 
+printf "scanning package.json for version match..."
+packageJsonCheckVersion "$DIR/$BASE/package.json" $V
+
+printf "scanning package-lock.json for version match..."
+packageJsonCheckVersion "$DIR/$BASE/package-lock.json" $V
+
 echo $(tput setaf 6)
 echo run the following command to remove the scratch space:
 echo "  rm -rf '$DIR'"