release.yml

name: Release

# Two ways to release:
#  1. Actions → "Release" → Run workflow → pick a semver bump (patch/minor/major).
#     It bumps the version everywhere, commits, tags `vX.Y.Z`, then builds &
#     publishes the binaries for Linux/macOS/Windows in the same run.
#  2. Push a tag yourself (`git tag v1.2.3 && git push --tags`) → it just builds
#     & publishes (you bumped the version files before tagging).
on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      bump:
        description: Semantic version bump
        type: choice
        options: [patch, minor, major]
        default: patch

permissions:
  contents: write

concurrency:
  group: release
  cancel-in-progress: false

jobs:
  version:
    # Only the manual path bumps + tags; pushed tags skip straight to build.
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.bump.outputs.tag }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Bump version, commit & tag
        id: bump
        run: |
          set -euo pipefail
          NEW="$(node scripts/bump-version.mjs "${{ inputs.bump }}")"
          echo "New version: $NEW"
          git config user.name 'github-actions[bot]'
          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
          git commit -am "chore(release): v$NEW"
          git tag "v$NEW"
          git push origin "HEAD:${GITHUB_REF_NAME}"
          git push origin "v$NEW"
          echo "tag=v$NEW" >> "$GITHUB_OUTPUT"

  build:
    needs: [version]
    # Run for a pushed tag, or after a successful bump on the manual path.
    if: ${{ always() && (github.event_name == 'push' || needs.version.result == 'success') }}
    permissions:
      contents: write
    uses: ./.github/workflows/build-release.yml
    with:
      tag: ${{ github.event_name == 'workflow_dispatch' && needs.version.outputs.tag || github.ref_name }}
    secrets: inherit