release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write
  id-token: write # required for npm provenance

jobs:
  release:
    name: Build, test, and publish to npm
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
        with:
          version: 9

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm
          registry-url: "https://registry.npmjs.org/"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build
        run: pnpm build

      - name: Lint
        run: pnpm lint

      - name: Test
        run: pnpm test

      - name: Resolve version
        id: version
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Verify package.json matches tag
        env:
          EXPECTED: ${{ steps.version.outputs.version }}
        run: |
          set -euo pipefail
          pkg=$(node -p "require('./package.json').version")
          echo "tag=$EXPECTED  package.json=$pkg"
          if [ "$pkg" != "$EXPECTED" ]; then
            echo "::error::package.json version ($pkg) does not match tag ($EXPECTED). Run 'pnpm release' instead of tagging manually."
            exit 1
          fi

      - name: Publish to npm
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish --access public --provenance

      - name: Create GitHub Release
        # Pinned to commit SHA of v2.6.2 (third-party action with contents: write).
        # Update by resolving the desired tag with:
        #   gh api repos/softprops/action-gh-release/git/refs/tags/<tag> --jq .object.sha
        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
        with:
          generate_release_notes: true
          draft: false
          prerelease: ${{ contains(github.ref_name, '-') }}