release.yml

name: Release

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      dry_run:
        description: "Run validation and package checks without publishing"
        required: true
        type: boolean
        default: true

permissions:
  contents: read

concurrency:
  group: release-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    name: Create release PR or publish
    runs-on: ubuntu-latest
    timeout-minutes: 20
    environment: npm
    permissions:
      contents: write
      pull-requests: write
      id-token: write

    steps:
      - name: Checkout
        uses: actions/checkout@v6.0.0
        with:
          fetch-depth: 0

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2.0.2
        with:
          bun-version: latest

      - name: Setup Node.js for npm trusted publishing
        uses: actions/setup-node@v6.3.0
        with:
          node-version: 24
          registry-url: "https://registry.npmjs.org"
          package-manager-cache: false

      - name: Verify npm trusted publishing requirements
        run: |
          node --version
          npm --version
          node -e "const [major, minor] = process.versions.node.split('.').map(Number); if (major < 22 || (major === 22 && minor < 14)) throw new Error('npm trusted publishing requires Node 22.14.0 or newer')"
          npm --version | node -e "let v=''; process.stdin.on('data', d => v += d); process.stdin.on('end', () => { const [major, minor, patch] = v.trim().split('.').map(Number); if (major < 11 || (major === 11 && (minor < 5 || (minor === 5 && patch < 1)))) throw new Error('npm trusted publishing requires npm 11.5.1 or newer'); })"

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Verify package
        run: bun run verify

      - name: Stop manual publishing outside main
        if: github.event_name == 'workflow_dispatch' && inputs.dry_run != true && github.ref != 'refs/heads/main'
        run: |
          echo "Publishing is only allowed from main." >&2
          exit 1

      - name: Verify npm package contents
        run: npm pack --dry-run --json

      - name: Create version PR or publish to npm
        if: github.ref == 'refs/heads/main' && !(github.event_name == 'workflow_dispatch' && inputs.dry_run)
        uses: changesets/action@v1
        with:
          version: bun run version-packages
          publish: npm publish --access public --provenance
          createGithubReleases: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}