release.yaml

name: Release

on:
  # Publish whenever a version tag is pushed, e.g. v1.2.3 or v1.2.3-rc.1.
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+*"

# contents: write -> create the GitHub release; id-token: write -> npm provenance.
permissions:
  contents: write
  id-token: write

jobs:
  release:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    env:
      # Tags with a hyphen suffix (e.g. -rc.1) are prereleases.
      PRERELEASE: ${{ contains(github.ref_name, '-') }}
    steps:
      - uses: actions/checkout@v7.0.1
      - uses: actions/setup-node@v7.0.0
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org # Wires up .npmrc for publish
      - run: npm install
      - run: npm run typecheck
      - run: npm run build # Compile src/ to dist/ before publishing
      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          # rc tags become GitHub prereleases; stable tags become full releases.
          # Skip if the release already exists so reruns stay idempotent.
          if gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1; then
            echo "Release $GITHUB_REF_NAME already exists"
          elif [ "$PRERELEASE" = "true" ]; then
            gh release create "$GITHUB_REF_NAME" --generate-notes --verify-tag --prerelease
          else
            gh release create "$GITHUB_REF_NAME" --generate-notes --verify-tag
          fi
      - name: Publish to npm
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          # rc tags publish under the "next" dist-tag, stable tags under "latest".
          # --access public is required for provenance on a new package.
          if [ "$PRERELEASE" = "true" ]; then
            npm publish --provenance --access public --tag next
          else
            npm publish --provenance --access public
          fi