release.yml

name: Release

on:
  push:
    tags: ['v*']

concurrency:
  # Releases must finish; never cancel mid-publish.
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
      discussions: write
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
        # Reads the pnpm version from package.json's `packageManager` field.
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - name: Publish to npm
        # Auth via npm Trusted Publishers (OIDC). Requires npm >= 11.5.1, which
        # ships with Node 24. No NPM_TOKEN secret — npm reads the GitHub Actions
        # OIDC token directly because `id-token: write` is granted above.
        #
        # `npm publish` triggers `prepublishOnly` (build + test + build:mcpb), so
        # the test/build steps are not duplicated here. The `.mcpb` is on disk
        # by the time the next step references it.
        run: npm publish --provenance --access public
      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          version="${GITHUB_REF_NAME#v}"
          gh release create "$GITHUB_REF_NAME" \
            "dist/nodus-context-${version}.mcpb" \
            --title "$GITHUB_REF_NAME" \
            --generate-notes \
            --discussion-category Announcements