release.yml

name: Release

on:
  workflow_run:
    workflows:
      - CI
    types:
      - completed
    branches:
      - master
  workflow_dispatch:
    inputs:
      version:
        description: Explicit version to release, such as 0.1.0 or v0.1.0.
        required: false
        type: string

permissions:
  contents: write
  id-token: write

concurrency:
  group: release
  cancel-in-progress: false

jobs:
  publish:
    name: Publish to npm
    runs-on: ubuntu-latest
    if: >-
      (github.event_name == 'workflow_run' &&
        github.event.workflow_run.conclusion == 'success' &&
        github.event.workflow_run.head_branch == 'master') ||
      (github.event_name == 'workflow_dispatch' &&
        github.ref == 'refs/heads/master')
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Setup Node
        uses: actions/setup-node@v5
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org
          package-manager-cache: false

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          run_install: false

      - name: Install git-cliff
        uses: taiki-e/install-action@git-cliff

      - name: Resolve release version
        id: version
        env:
          VERSION_OVERRIDE: ${{ github.event.inputs.version || '' }}
        run: |
          set -euo pipefail
          current_version="$(node -p "require('./package.json').version")"

          if [ -n "$VERSION_OVERRIDE" ]; then
            next_version="${VERSION_OVERRIDE#v}"
            if ! node -e "process.exit(/^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(process.argv[1]) ? 0 : 1)" "$next_version"; then
              echo "Invalid version override: $VERSION_OVERRIDE" >&2
              exit 1
            fi
            echo "Using explicit version override: $next_version"
          else
            next_version="$(git-cliff --bumped-version | sed 's/^v//')"
          fi

          if [ -z "$next_version" ]; then
            echo "git-cliff did not infer a version" >&2
            exit 1
          fi

          if [ -z "$VERSION_OVERRIDE" ] && [ "$next_version" = "$current_version" ]; then
            echo "git-cliff inferred $next_version, which matches package.json; skipping release."
            echo "should_release=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          if git rev-parse --verify --quiet "v$next_version" >/dev/null; then
            echo "Release tag v$next_version already exists" >&2
            exit 1
          fi

          echo "should_release=true" >> "$GITHUB_OUTPUT"
          echo "version=$next_version" >> "$GITHUB_OUTPUT"
          echo "tag=v$next_version" >> "$GITHUB_OUTPUT"

      - name: Install dependencies
        if: steps.version.outputs.should_release == 'true'
        run: pnpm install --frozen-lockfile

      - name: Bump package version
        if: steps.version.outputs.should_release == 'true'
        run: npm pkg set version="${{ steps.version.outputs.version }}"

      - name: Build
        if: steps.version.outputs.should_release == 'true'
        run: pnpm run --if-present build

      - name: Commit release updates
        if: steps.version.outputs.should_release == 'true'
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add package.json
          if git diff --cached --quiet; then
            git commit --allow-empty -m "chore(release): ${{ steps.version.outputs.tag }}"
          else
            git commit -m "chore(release): ${{ steps.version.outputs.tag }}"
          fi
          git tag "${{ steps.version.outputs.tag }}"
          git push origin HEAD:master
          git push origin "${{ steps.version.outputs.tag }}"

      - name: Publish to npm with provenance
        if: steps.version.outputs.should_release == 'true'
        run: npm publish --provenance --access public