release.yaml

name: CI / Release

on:
  workflow_dispatch:
  push:
    paths-ignore:
      - .github/**
      - '!.github/workflows/release.yaml'
      - '**/*.md'
    branches:
      - '([0-9])?(.{+([0-9]),x}).x'
      - main
      - next
      - next-major
      - alpha
      - beta
      - 'feat/*'
      - 'fix/*'

permissions:
  contents: read

concurrency:
  group: ci-release-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  NODE_VERSION: 24

jobs:
  release:
    name: CI / Release
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: write
      issues: write
      pull-requests: write
      id-token: write

    steps:
      - name: Harden runner
        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
        with:
          egress-policy: audit

      - name: Git checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Setup PNPM
        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0

      - name: Use Node.js ${{ env.NODE_VERSION }}
        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          registry-url: https://registry.npmjs.org
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install packages
        run: pnpm install --frozen-lockfile

      - name: Verify installed prod dependency attestations
        run: node --run audit

      - name: Setup Turbo cache
        uses: dtinth/setup-github-actions-caching-for-turbo@cc723b4600e40a6b8815b65701d8614b91e2669e # v1.3.0

      - name: Clean build outputs
        run: node --run clean

      - name: Build packages
        run: node --run build

      - name: Cache ESLint results
        uses: actions/cache@v4
        with:
          path: .eslintcache
          key:
            eslint-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml',
            'eslint.config.js') }}

      - name: Lint JS and TS
        run: node --run lint:es

      - name: Lint CSS
        run: node --run lint:style

      - name: Check formatting
        run: node --run format

      - name: Tests - units
        run: node --run test:unit

      - name: Tests - types
        run: node --run test:types

      - name: Cache Playwright browsers
        uses: actions/cache@v4
        with:
          path: ~/.cache/ms-playwright
          key: playwright-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}

      - name: Install Playwright browsers
        run: pnpm exec playwright install --with-deps chromium

      - name: Tests - E2E
        run: node --run test:e2e

      - name: Git user configuration
        if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/next'
        run: |
          git config --global user.name "${{ github.actor }}"
          git config --global user.email "${{ github.actor }}@users.noreply.github.com"

      - name: Publish [main]
        if: github.ref == 'refs/heads/main'
        id: graduateRelease
        continue-on-error: true
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_CONFIG_PROVENANCE: 'true'
        run: |
          pnpm exec lerna publish --message 'chore: publish [main] release [skip ci]' --create-release=github --conventional-graduate --force-git-tag --yes

      - name: Publish [main] fallback
        if:
          ${{ always() && github.ref == 'refs/heads/main' &&
          steps.graduateRelease.outcome == 'failure' }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_CONFIG_PROVENANCE: 'true'
        run: |
          echo "Graduate publish failed - attempting recovery"
          git stash || true

          echo "==> from-package: recovering partial publish"
          FROM_PKG_OUT=$(pnpm exec lerna publish from-package --yes 2>&1)
          FROM_PKG_EXIT=$?
          echo "$FROM_PKG_OUT"

          echo "==> non-graduate: publishing new or changed packages"
          OUTPUT=$(pnpm exec lerna publish --message 'chore: publish [main] release [skip ci]' --create-release=github --yes 2>&1) || true
          echo "$OUTPUT"

          if [ "$FROM_PKG_EXIT" -ne 0 ] && echo "$OUTPUT" | grep -q 'No changed packages to publish'; then
            echo "::error::Neither from-package nor conventional fallback published anything"
            exit 1
          fi

      - name: Publish [next]
        if: github.ref == 'refs/heads/next'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_CONFIG_PROVENANCE: 'true'
        run: |
          pnpm exec lerna publish --message 'chore: publish [next] pre-release' --conventional-prerelease --pre-dist-tag=next --preid=next --yes

      - name: Merge back main into next
        if: github.ref == 'refs/heads/main'
        continue-on-error: true
        env:
          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
        run: |
          git checkout next
          git merge main --no-ff -m 'chore: auto-merge main into next [skip ci]'
          git push