release.yml

name: Release

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      dry_run:
        description: "Run validation and package checks without publishing"
        required: true
        type: boolean
        default: true

permissions:
  contents: read

concurrency:
  group: release-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    name: Create release PR or publish
    runs-on: ubuntu-latest
    timeout-minutes: 20
    environment: npm
    permissions:
      contents: write
      pull-requests: write
      id-token: write

    steps:
      - name: Checkout
        uses: actions/checkout@v7.0.0
        with:
          fetch-depth: 0

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2.2.0
        with:
          bun-version: latest

      - name: Setup Node.js for npm trusted publishing
        uses: actions/setup-node@v6.4.0
        with:
          node-version: 24
          registry-url: "https://registry.npmjs.org"
          package-manager-cache: false

      - name: Install supported npm for trusted publishing
        run: npm install --global npm@11.18.0

      - name: Verify npm trusted publishing requirements
        run: |
          node --version
          npm --version
          node -e "const [major, minor] = process.versions.node.split('.').map(Number); if (major < 22 || (major === 22 && minor < 14)) throw new Error('npm trusted publishing requires Node 22.14.0 or newer')"
          npm --version | node -e "let v=''; process.stdin.on('data', d => v += d); process.stdin.on('end', () => { const [major, minor, patch] = v.trim().split('.').map(Number); if (major < 11 || (major === 11 && (minor < 5 || (minor === 5 && patch < 1)))) throw new Error('npm trusted publishing requires npm 11.5.1 or newer'); })"

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Verify package
        run: bun run verify

      - name: Stop manual publishing outside main
        if: github.event_name == 'workflow_dispatch' && inputs.dry_run != true && github.ref != 'refs/heads/main'
        run: |
          echo "Publishing is only allowed from main." >&2
          exit 1

      - name: Verify npm package contents
        run: npm pack --dry-run --json

      - name: Detect pending changesets
        id: changesets
        shell: bash
        run: |
          shopt -s nullglob
          files=(.changeset/*.md)
          if (( ${#files[@]} > 0 )); then
            echo "pending=true" >> "$GITHUB_OUTPUT"
          else
            echo "pending=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Create or update version PR
        if: github.ref == 'refs/heads/main' && !(github.event_name == 'workflow_dispatch' && inputs.dry_run) && steps.changesets.outputs.pending == 'true'
        uses: changesets/action@v1
        with:
          version: bun run version-packages
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Read package metadata
        if: github.ref == 'refs/heads/main' && !(github.event_name == 'workflow_dispatch' && inputs.dry_run) && steps.changesets.outputs.pending == 'false'
        id: package
        shell: bash
        run: |
          echo "name=$(node -p "require('./package.json').name")" >> "$GITHUB_OUTPUT"
          echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT"

      - name: Check whether package version is already published
        if: github.ref == 'refs/heads/main' && !(github.event_name == 'workflow_dispatch' && inputs.dry_run) && steps.changesets.outputs.pending == 'false'
        id: registry
        shell: bash
        run: |
          if npm view "${{ steps.package.outputs.name }}@${{ steps.package.outputs.version }}" version >/dev/null 2>&1; then
            echo "published=true" >> "$GITHUB_OUTPUT"
          else
            echo "published=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Publish package to npm
        if: github.ref == 'refs/heads/main' && !(github.event_name == 'workflow_dispatch' && inputs.dry_run) && steps.changesets.outputs.pending == 'false' && steps.registry.outputs.published == 'false'
        run: npm publish --access public --provenance

      - name: Create GitHub release
        if: github.ref == 'refs/heads/main' && !(github.event_name == 'workflow_dispatch' && inputs.dry_run) && steps.changesets.outputs.pending == 'false'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ steps.package.outputs.version }}
        shell: bash
        run: |
          tag="v${VERSION}"
          if gh release view "$tag" >/dev/null 2>&1; then
            echo "GitHub release $tag already exists"
          else
            gh release create "$tag" --target "$GITHUB_SHA" --title "$tag" --generate-notes
          fi