release.yml

name: Release

on:
  push:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}

jobs:
  release:
    name: Version & Publish
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          # Authenticate git with a PAT (or GitHub App token) rather than the
          # default GITHUB_TOKEN so the commits the changesets action pushes to
          # `changeset-release/main` trigger CI. GitHub suppresses workflow runs
          # on GITHUB_TOKEN-authored pushes (recursion guard), which leaves the
          # version PR with no required status checks and unmergeable until
          # someone re-triggers it. Falls back to GITHUB_TOKEN when RELEASE_PAT
          # isn't configured, so releases keep working regardless.
          token: ${{ secrets.RELEASE_PAT || secrets.GITHUB_TOKEN }}

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
          registry-url: https://registry.npmjs.org

      - run: pnpm install --frozen-lockfile

      # The `release` script builds packages/* before `changeset publish`.
      - name: Create Release PR or Publish
        uses: changesets/action@v1
        with:
          title: "chore: version packages"
          commit: "chore: version packages"
          version: pnpm changeset:version
          publish: pnpm release
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_PAT || secrets.GITHUB_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}