build.yml

name: Build release

on:
  workflow_dispatch:
  push:
    branches:
      - main

env:
  CI: true
  DEPLOYMENT_APP_ID: 957224

permissions:
  id-token: write  # Required for OIDC
  contents: read

jobs:
  release:
    permissions:
      contents: write
    runs-on: ubuntu-latest
    environment: production
    steps:
      - name: Authenticate with GitHub App
        uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: ${{ env.DEPLOYMENT_APP_ID }}
          private-key: ${{ secrets.DEPLOYMENT_APP_PRIVATE_KEY }}

      - name: Checkout
        id: checkout
        uses: actions/checkout@v4
        with:
          token: ${{ steps.app-token.outputs.token }}
          fetch-depth: 1 # shallow copy

      - name: Fetch Refs
        run: |
          git fetch origin --depth 1 ${{ github.ref_name }}

      - uses: actions/setup-node@v4
        with:
          node-version-file: package.json
          registry-url: 'https://registry.npmjs.org'

      # Ensure npm 11.5.1 or later is installed - required for OIDC
      - name: Update npm
        run: npm install -g npm@latest

      - name: Build release artifact
        run: |
          cd packages/cli
          npm run publish

      - name: Get package version
        id: version
        run: |
          cd packages/cli
          echo "VERSION=$(npm run --silent version)" >> $GITHUB_OUTPUT

      - name: Create Release
        id: create_release
        uses: actions/create-release@latest
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
        with:
          commitish: ${{ github.sha }}
          tag_name: ${{ steps.version.outputs.VERSION }}
          release_name: ${{ steps.version.outputs.VERSION }}
          draft: false
          prerelease: false

      - name: Publish package
        run: |
          cd packages/cli
          npm run publish