release.yml

name: Release

# Publishes both packages to npm with provenance attestation when a version
# tag is pushed. Flow:
#
#   pnpm version-packages X.Y.Z && pnpm install
#   git commit -am "chore(release): vX.Y.Z"
#   git tag vX.Y.Z && git push origin main vX.Y.Z
#
# Auth is npm "trusted publishing" (OIDC): this repo+workflow is registered
# as a trusted publisher for both packages on npmjs.com, so no token secret
# exists at all — npm mints a short-lived credential from the id-token
# permission below, and provenance is attached automatically. The publish
# step runs under pnpm 11 (via npx) because native OIDC support landed in
# pnpm 11.1.3; the rest of the workflow stays on the workspace-pinned pnpm.

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write # create the GitHub release
  id-token: write # OIDC token for npm trusted publishing + provenance

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    name: Verify & publish
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      # No registry-url: with trusted publishing there is no auth token, and
      # registry-url would write an .npmrc with an unresolved ${NODE_AUTH_TOKEN}
      # placeholder that interferes with the OIDC flow.
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Verify tag matches package version
        run: |
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          PKG_VERSION="$(node -p "require('./package.json').version")"
          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
            echo "::error::Tag v${TAG_VERSION} does not match package.json version ${PKG_VERSION}"
            exit 1
          fi

      # Full quality gate — mirrors CI so a tag can't ship anything main
      # wouldn't accept. Build runs first: mantine's typecheck/tests resolve
      # @ai-react-markdown/core through its exports map, which points at dist/.
      - name: Lint
        run: pnpm lint

      - name: Format check
        run: pnpm format:check

      - name: Build
        run: pnpm build

      - name: Typecheck
        run: pnpm -r typecheck

      # Per-package unit suites, matching the CI gate.
      - name: Test
        run: pnpm -r test

      # Browser smokes, matching CI's browser-smoke task: the root vitest
      # config's `storybook` project renders every story in headless Chromium.
      - name: Install Playwright Chromium
        run: pnpm exec playwright install chromium --with-deps

      - name: Browser smokes (storybook stories)
        run: pnpm vitest run --project=storybook

      # pnpm delegates the actual upload to the npm CLI, and the OIDC token
      # exchange happens there — npm 10.x (bundled with Node 22) predates
      # trusted publishing and dies with ENEEDAUTH.
      - name: Upgrade npm (OIDC exchange needs ≥ 11.5.1)
        run: npm install -g npm@^11.5.1 && npm --version

      - name: Publish to npm (OIDC trusted publishing + provenance)
        run: npx -y pnpm@^11.1.3 publish -r --access public --no-git-checks

      # Notes come from the version's section in docs/release-highlights.md —
      # the hand-written changelog — falling back to GitHub's auto-generated
      # notes if no section exists for this version.
      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          awk -v ver="$VERSION" '
            index($0, "### " ver " ") == 1 { found = 1; next }
            found && /^### / { exit }
            found { print }
          ' docs/release-highlights.md > /tmp/release-notes.md
          if [ -s /tmp/release-notes.md ]; then
            gh release create "$GITHUB_REF_NAME" --title "$GITHUB_REF_NAME" --notes-file /tmp/release-notes.md --verify-tag
          else
            gh release create "$GITHUB_REF_NAME" --title "$GITHUB_REF_NAME" --generate-notes --verify-tag
          fi