release.yml

name: Release

on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      tag:
        description: 'Existing stable release tag to retry npm publishing (leave empty to update the release PR)'
        required: false
        type: string

permissions:
  contents: read

concurrency:
  group: release
  cancel-in-progress: false

jobs:
  release:
    if: github.ref == 'refs/heads/main' && inputs.tag == ''
    runs-on: ubuntu-latest
    outputs:
      created: ${{ steps.release.outputs.release_created }}
      tag: ${{ steps.release.outputs.tag_name }}
    steps:
      - name: Check release credentials
        env:
          RELEASE_PLEASE_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
        run: |
          if [ -z "$RELEASE_PLEASE_TOKEN" ]; then
            echo '::error::Set RELEASE_PLEASE_TOKEN to a fine-grained token with Contents and Pull requests write access. See docs/releasing.md.'
            exit 1
          fi
      - uses: googleapis/release-please-action@v4
        id: release
        with:
          token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json

  publish:
    needs: release
    if: >-
      always() && github.ref == 'refs/heads/main' &&
      (needs.release.outputs.created == 'true' ||
       (github.event_name == 'workflow_dispatch' && inputs.tag != ''))
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    env:
      RELEASE_TAG: ${{ needs.release.outputs.tag || inputs.tag }}
    steps:
      - name: Validate tag format
        run: |
          if ! [[ "$RELEASE_TAG" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
            echo '::error::Expected a stable release tag such as 0.1.17.'
            exit 1
          fi
      - uses: actions/checkout@v6
        with:
          ref: refs/tags/${{ env.RELEASE_TAG }}
          persist-credentials: false
      - uses: actions/setup-node@v6
        with:
          node-version: '24'
          registry-url: 'https://registry.npmjs.org'
          package-manager-cache: false
      - run: node scripts/release.mjs verify "$RELEASE_TAG"
      - name: Check whether npm already has this version
        id: registry
        run: node scripts/release.mjs published >> "$GITHUB_OUTPUT"
      - uses: oven-sh/setup-bun@v2
        if: steps.registry.outputs.published != 'true'
        with:
          bun-version: '1.4.0'
      - name: Install dependencies
        if: steps.registry.outputs.published != 'true'
        run: bun install --frozen-lockfile
      - name: Check and build the release
        if: steps.registry.outputs.published != 'true'
        run: bun run check
      - name: Pack the checked root package
        if: steps.registry.outputs.published != 'true'
        id: pack
        run: |
          npm pack --json > "$RUNNER_TEMP/package.json"
          node scripts/release.mjs packed "$RUNNER_TEMP/package.json" >> "$GITHUB_OUTPUT"
      - name: Publish to npm with trusted publishing
        if: steps.registry.outputs.published != 'true'
        env:
          PACKAGE_FILE: ${{ steps.pack.outputs.filename }}
        run: npm publish "./$PACKAGE_FILE" --access public --tag latest --provenance
      - name: Already published
        if: steps.registry.outputs.published == 'true'
        run: echo "The npm version for $RELEASE_TAG is already published; nothing to do."