build.yml

name: build
on:
  push:
    branches: [main]
  pull_request:
    types: [labeled, synchronize]

permissions:
  contents: write        # Create releases and tags
  pull-requests: write   # Comment on PRs with release info
  packages: write        # Publish to GitHub Packages

concurrency:
  group: release-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  build-linting:
    if: github.event_name == 'push'
    uses: ./.github/workflows/linting.yml

  release:
    needs: [build-linting]
    runs-on: ubuntu-latest
    if: >-
      !failure() && !cancelled() &&
      ((github.event_name == 'push'
        && !contains(github.event.head_commit.message, 'ci skip')
        && !contains(github.event.head_commit.message, 'skip ci'))
      || (github.event_name == 'pull_request'
        && ((github.event.action == 'labeled' && github.event.label.name == 'canary')
        || (github.event.action == 'synchronize'
          && contains(github.event.pull_request.labels.*.name, 'canary')))))
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.ref || github.ref }}
          fetch-depth: 0             # auto shipit needs full commit graph + tags
          filter: 'blob:none'        # skip historical blobs to speed checkout
          persist-credentials: false # https://stackoverflow.com/questions/74744498/github-pushing-to-protected-branches-with-fine-grained-token

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          cache: true

      - name: Setup npm for GitHub Packages
        run: |
          echo -e "\n//npm.pkg.github.com/:_authToken=$GITHUB_TOKEN" >> .npmrc
          echo -e "\n//npm.pkg.github.com/:_authToken=$GITHUB_TOKEN" >> ~/.npmrc
          echo -e "\n//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> .npmrc
          echo -e "\n//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build all tools
        run: pnpm -r --filter './tools/**' run build

      - name: Reset .npmrc
        run: git checkout -- .npmrc

      - name: Verify npm auth
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          echo "//registry.npmjs.org/:_authToken=\${NPM_TOKEN}" > ~/.npmrc
          npm whoami --registry=https://registry.npmjs.org/

      - name: Create Release
        env:
          GITHUB_TOKEN: ${{ github.ref == 'refs/heads/main' && secrets.NEVERMORE_CI_PAT || secrets.GITHUB_TOKEN }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npx auto shipit