release.yml

name: Release

on:
  push:
    branches: [main]

# Declare default permissions as read only.
permissions: read-all

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
        with:
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            cli.codecov.io:443
            github.com:443
            ingest.codecov.io:443
            keybase.io:443
            o26192.ingest.us.sentry.io:443
            registry.npmjs.org:443
            release-assets.githubusercontent.com:443
            storage.googleapis.com:443

      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version-file: '.nvmrc'

      - name: Install pnpm
        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
        with:
          version: 10.30.3

      - name: Get pnpm store directory
        id: pnpm-store
        shell: bash
        run: echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT

      - name: Cache pnpm store
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: ${{ steps.pnpm-store.outputs.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Lint
        run: pnpm lint

      - name: Unit tests with coverage
        run: pnpm test:coverage

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
        with:
          files: ./coverage/lcov.info
          token: ${{ secrets.CODECOV_TOKEN }}

      - name: Build application
        env:
          PUBLIC_SUPABASE_URL: ${{ vars.PUBLIC_SUPABASE_URL || 'https://placeholder.supabase.co' }}
          PUBLIC_SUPABASE_ANON_KEY: ${{ vars.PUBLIC_SUPABASE_ANON_KEY || 'placeholder-anon-key' }}
        run: pnpm run build

  release:
    name: Release
    runs-on: ubuntu-latest
    needs: test
    permissions:
      contents: write
      issues: write
      pull-requests: write
      id-token: write
      attestations: write
    outputs:
      new_release_published: ${{ steps.semantic-release.outputs.new_release_published }}
      new_release_version: ${{ steps.semantic-release.outputs.new_release_version }}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
        with:
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            cli.codecov.io:443
            github.com:443
            ingest.codecov.io:443
            keybase.io:443
            o26192.ingest.us.sentry.io:443
            registry.npmjs.org:443
            release-assets.githubusercontent.com:443
            storage.googleapis.com:443

      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version-file: '.nvmrc'

      - name: Install pnpm
        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
        with:
          version: 10.30.3

      - name: Get pnpm store directory
        id: pnpm-store
        shell: bash
        run: echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT

      - name: Cache pnpm store
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: ${{ steps.pnpm-store.outputs.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Audit dependencies
        run: pnpm audit --audit-level=high

      - name: Generate GitHub App token
        id: app-token
        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
        with:
          app-id: ${{ vars.TIMOA_BOT_APP_ID }}
          private-key: ${{ secrets.TIMOA_BOT_PRIVATE_KEY }}

      - name: Configure git to use GitHub App token for push
        run: |
          git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "https://github.com/"
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}

      - name: Release
        id: semantic-release
        uses: cycjimmy/semantic-release-action@b12c8f6015dc215fe37bc154d4ad456dd3833c90 # v6.0.0
        with:
          semantic_version: 24
          extra_plugins: |
            @semantic-release/changelog@6.0.3
            @semantic-release/git@10.0.1
            @semantic-release/npm@13.1.5
            @semantic-release/github@9.2.6
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

  deploy:
    name: Deploy
    needs: release
    if: needs.release.outputs.new_release_published == 'true'
    uses: ./.github/workflows/deploy.yml
    with:
      ref: main
    permissions:
      contents: read
      actions: read
      attestations: read
      checks: read
      deployments: read
      discussions: read
      issues: read
      packages: read
      pages: read
      pull-requests: read
      repository-projects: read
      security-events: read
      statuses: read
    secrets: inherit