release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      dry-run:
        description: 'Dry run (no publish, no tag push, no git push)'
        type: boolean
        default: false

concurrency:
  group: release
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest
    environment: npm-production

    permissions:
      contents: write
      # `id-token: write` lets the runner mint the OIDC token that npm
      # Trusted Publishing exchanges for a short-lived publish credential.
      # Without this, `npm publish` falls back to looking for NPM_TOKEN.
      id-token: write
      issues: write
      pull-requests: write

    steps:
      # Check out over SSH using the release deploy key. The key has write
      # access and is on the `main` ruleset bypass list, so the version-bump
      # commit and tag can push directly even with branch protection on.
      #
      # `ref: main` is required: without it, a workflow_dispatch checkout can
      # land on a detached HEAD, so release-it's version-bump + CHANGELOG commit
      # is tagged and published but never pushed back onto `main` (the tag ends
      # up on no branch). Pinning the branch keeps the tag and `main` aligned so
      # the CHANGELOG stays in sync with the released version.
      - name: Checkout
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          ref: main
          fetch-depth: 0
          ssh-key: ${{ secrets.RELEASE_DEPLOY_KEY }}

      - name: Setup
        uses: ./.github/actions/setup

      - name: Lint
        run: yarn lint

      - name: Typecheck
        run: yarn typecheck

      - name: Test
        run: yarn test --maxWorkers=2

      - name: Build library
        run: yarn prepare

      - name: Configure git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Release
        env:
          # Git pushes (branch + tag) go over SSH using the deploy key from
          # checkout above. GITHUB_TOKEN is only used by release-it for the
          # GitHub Release API call, which is not covered by branch protection.
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # No NPM_TOKEN: authentication is via npm Trusted Publishing (OIDC).
          # Provenance attestation is required for Trusted Publishing.
          NPM_CONFIG_PROVENANCE: 'true'
        run: |
          if [[ "${{ inputs.dry-run }}" == "true" ]]; then
            yarn release --ci --dry-run
          else
            yarn release --ci
          fi