release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      bump:
        description: "Version bump level"
        required: false
        default: "patch"
        type: choice
        options:
          - patch
          - minor
          - major

permissions:
  contents: write
  id-token: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          token: ${{ secrets.RELEASE_PAT }}

      - uses: actions/setup-node@v4
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org

      - name: Bump version
        id: version
        run: |
          BUMP="${{ inputs.bump || 'patch' }}"
          OLD=$(node -p 'require("./package.json").version')
          IFS='.' read -r MAJOR MINOR PATCH <<< "$OLD"
          case "$BUMP" in
            major) MAJOR=$((MAJOR + 1)); MINOR=0; PATCH=0 ;;
            minor) MINOR=$((MINOR + 1)); PATCH=0 ;;
            patch) PATCH=$((PATCH + 1)) ;;
          esac
          NEW="${MAJOR}.${MINOR}.${PATCH}"
          npm version "$NEW" --no-git-tag-version
          echo "version=$NEW" >> "$GITHUB_OUTPUT"
          echo "old=$OLD" >> "$GITHUB_OUTPUT"
          echo "Bumped $OLD → $NEW ($BUMP)"

      - run: npm ci
      - run: npm run typecheck
      - run: npm test
      - run: npm run build

      # Clear the token placeholder so npm falls through to OIDC auth.
      - name: Publish to npm
        run: |
          npm config delete //registry.npmjs.org/:_authToken || true
          npm publish --access public

      # PAT checkout token bypasses branch protection (owner is repo admin).
      - name: Commit version bump, tag, and push
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add package.json package-lock.json
          git commit -m "release: v${{ steps.version.outputs.version }}"
          git tag -a "v${{ steps.version.outputs.version }}" -m "Release v${{ steps.version.outputs.version }}"
          git push origin HEAD:main
          git push origin "v${{ steps.version.outputs.version }}"

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "v${{ steps.version.outputs.version }}" \
            --title "v${{ steps.version.outputs.version }}" \
            --generate-notes