release.yml

name: Release

on:
  push:
    tags:
      - '11.*'

permissions:
  contents: read

jobs:
  build:
    if: github.event.deleted == false
    permissions:
      contents: read
    uses: ./.github/workflows/build-test.yml

  release:
    runs-on: ubuntu-latest
    needs: build
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: npm-package
      - name: Create draft release and upload artifact
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail

          TAG="$GITHUB_REF_NAME"
          if gh release view "$TAG" >/dev/null 2>&1; then
            if [[ "$(gh release view "$TAG" --json isDraft --jq .isDraft)" != "true" ]]; then
              echo "::error::Release '$TAG' already exists and is not a draft"
              exit 1
            fi
          else
            ARGS=(--draft --target "$GITHUB_SHA" --title "$TAG")
            if [[ "$TAG" == *-* ]]; then
              ARGS+=(--prerelease)
            fi
            gh release create "$TAG" "${ARGS[@]}"
          fi

          ASSET="preact-${TAG#v}.tgz"
          mv preact.tgz "$ASSET"
          gh release upload "$TAG" "$ASSET" --clobber

  publish:
    needs: [build, release]
    runs-on: ubuntu-latest
    environment:
      name: npm
      url: https://www.npmjs.com/package/preact
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: npm-package

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          package-manager-cache: false
          node-version: '24'
          registry-url: 'https://registry.npmjs.org'

      - name: Update npm
        run: npm install -g npm@11.15.0

      - name: Validate package
        run: |
          set -euo pipefail

          TAG="${GITHUB_REF_NAME}"
          mkdir -p package-metadata
          tar -xOf preact.tgz package/package.json > package-metadata/package.json

          PACKAGE_NAME="$(node -p "require('./package-metadata/package.json').name")"
          PACKAGE_VERSION="$(node -p "require('./package-metadata/package.json').version")"

          if [[ "$PACKAGE_NAME" != "preact" ]]; then
            echo "::error::Expected package name 'preact', got '$PACKAGE_NAME'"
            exit 1
          fi

          if [[ "$PACKAGE_VERSION" != "$TAG" ]]; then
            echo "::error::Tag '$TAG' does not match package version '$PACKAGE_VERSION'"
            exit 1
          fi

      # Determine the npm dist-tag from the git tag:
      # - Stable versions publish with --tag latest
      # - Prerelease versions must use an approved prerelease identifier as the
      #   dist-tag (11.0.0-rc.1 -> rc, 11.0.0-beta.1 -> beta)
      - name: Determine dist-tag
        id: dist-tag
        run: |
          set -euo pipefail

          TAG="${GITHUB_REF_NAME}"
          if [[ "$TAG" =~ ^11\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
            echo "tag=latest" >> "$GITHUB_OUTPUT"
          elif [[ "$TAG" =~ ^11\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)-([0-9A-Za-z-]+)(\.[0-9A-Za-z-]+)*$ ]]; then
            DIST_TAG="${BASH_REMATCH[3]}"
            case "$DIST_TAG" in
              alpha|beta|rc|next)
                echo "tag=$DIST_TAG" >> "$GITHUB_OUTPUT"
                ;;
              *)
                echo "::error::Refusing to publish prerelease '$TAG' with unapproved npm dist-tag '$DIST_TAG'"
                exit 1
                ;;
            esac
          else
            echo "::error::Unexpected release tag '$TAG'"
            exit 1
          fi

      - name: Publish to npm
        run: npm stage publish preact.tgz --provenance --access public --tag "${{ steps.dist-tag.outputs.tag }}"