release.yml

name: Release

on:
  pull_request:
    branches: [release]
    types: [closed]
  push:
    tags: ['v[0-9]*', '[0-9]*']

permissions:
  contents: read

# Automatic and manual releases share one publisher. Never cancel an active publication.
concurrency:
  group: release-publication
  cancel-in-progress: false

jobs:
  release:
    name: Publish from release and open promotion PR
    if: github.event_name == 'push' || (github.event.pull_request.merged == true && github.event.pull_request.head.ref == 'devel' && github.event.pull_request.head.repo.full_name == github.repository)
    runs-on: ubuntu-latest
    timeout-minutes: 25
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Check out release
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: release
          fetch-depth: 0
      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22
          cache: npm
      - name: Install pipeline dependencies
        run: npm ci --ignore-scripts
      - name: Publish, prepare main PR, and synchronize devel
        env:
          GH_TOKEN: ${{ github.token }}
        run: node scripts/release-pipeline.mjs
      - name: Preserve built release files for diagnostics
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-package
          path: ${{ runner.temp }}/release/*
          if-no-files-found: ignore
          retention-days: 7