chore: fix workflows

Author: kmendell

.github/workflows/ci.yml

@@ -31,14 +31,31 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Lint and test
-        run: just lint all
+      - name: Check formatting
+        run: pnpm format:check
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Typecheck
+        run: pnpm typecheck
+
+      - name: Test
+        run: pnpm test
+
+      - name: Validate action metadata
+        run: pnpm validate:action
 
       - name: Build dist
         run: pnpm build
 
       - name: Verify dist is current
         run: git diff --exit-code -- dist/index.js
 
+      - name: Download actionlint
+        run: bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/v1.7.12/scripts/download-actionlint.bash) 1.7.12
+        shell: bash
+
       - name: Validate workflows
-        uses: rhysd/actionlint@v1
+        run: ./actionlint -color
+        shell: bash

.github/workflows/release.yml

@@ -0,0 +1,122 @@
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Action release version to publish, for example v1.0.0
+        required: true
+        type: string
+      prerelease:
+        description: Mark the GitHub release as a prerelease and skip the major tag update
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Setup PNPM
+        uses: pnpm/action-setup@v6
+        with:
+          run_install: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Check formatting
+        run: pnpm format:check
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Typecheck
+        run: pnpm typecheck
+
+      - name: Test
+        run: pnpm test
+
+      - name: Validate action metadata
+        run: pnpm validate:action
+
+      - name: Build dist
+        run: pnpm build
+
+      - name: Verify dist is current
+        run: git diff --exit-code -- dist/index.js
+
+      - name: Validate release version
+        id: release
+        env:
+          RELEASE_VERSION: ${{ inputs.version }}
+        run: |
+          set -euo pipefail
+
+          if [[ ! "$RELEASE_VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
+            echo "::error::Release version must look like v1.0.0"
+            exit 1
+          fi
+
+          if git rev-parse -q --verify "refs/tags/$RELEASE_VERSION" >/dev/null; then
+            echo "::error::Tag $RELEASE_VERSION already exists"
+            exit 1
+          fi
+
+          version_without_prefix="${RELEASE_VERSION#v}"
+          major_version="v${version_without_prefix%%.*}"
+
+          echo "version=$RELEASE_VERSION" >> "$GITHUB_OUTPUT"
+          echo "major=$major_version" >> "$GITHUB_OUTPUT"
+        shell: bash
+
+      - name: Create immutable version tag
+        env:
+          RELEASE_VERSION: ${{ steps.release.outputs.version }}
+        run: |
+          set -euo pipefail
+          git tag "$RELEASE_VERSION" "$GITHUB_SHA"
+          git push origin "refs/tags/$RELEASE_VERSION"
+        shell: bash
+
+      - name: Update major version tag
+        if: ${{ !inputs.prerelease }}
+        env:
+          MAJOR_VERSION: ${{ steps.release.outputs.major }}
+        run: |
+          set -euo pipefail
+          git tag -f "$MAJOR_VERSION" "$GITHUB_SHA"
+          git push --force origin "refs/tags/$MAJOR_VERSION"
+        shell: bash
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PRERELEASE: ${{ inputs.prerelease }}
+          RELEASE_VERSION: ${{ steps.release.outputs.version }}
+        run: |
+          set -euo pipefail
+
+          args=(release create "$RELEASE_VERSION" --title "$RELEASE_VERSION" --generate-notes)
+
+          if [[ "$PRERELEASE" == "true" ]]; then
+            args+=(--prerelease)
+          fi
+
+          gh "${args[@]}"
+        shell: bash