publish.yml

name: Publish

on:
  workflow_dispatch:

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10.12.4

      - name: Use Node.js 22.14
        uses: actions/setup-node@v4
        with:
          node-version: 22.14.0
          cache: pnpm
          registry-url: https://registry.npmjs.org

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Upgrade npm for trusted publishing
        run: npm install -g npm@latest

      - name: Print runtime versions
        run: node -v && npm -v

      - name: Publish current main release
        run: pnpm release

      - name: Read package version
        id: package_version
        run: echo "version=$(node -p \"require('./package.json').version\")" >> "$GITHUB_OUTPUT"

      - name: Create Git tag if missing
        run: |
          TAG="v${{ steps.package_version.outputs.version }}"
          if git rev-parse "$TAG" >/dev/null 2>&1; then
            echo "Tag $TAG already exists"
            exit 0
          fi
          git tag "$TAG"
          git push origin "$TAG"

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="v${{ steps.package_version.outputs.version }}"
          gh release create "$TAG" \
            --title "$TAG" \
            --generate-notes \
            --verify-tag