release.yml

name: Release

on:
  push:
    branches: [main, dev]
  workflow_dispatch:

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  test:
    name: test (node 22)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm lint
      - run: pnpm test
      - run: pnpm build

  release:
    name: semantic-release
    needs: test
    runs-on: ubuntu-latest
    permissions:
      contents: write
      issues: write
      pull-requests: write
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
          registry-url: https://registry.npmjs.org
      # npm CLI >= 11.5.1 detects the GitHub Actions OIDC token via
      # ACTIONS_ID_TOKEN_REQUEST_URL/_TOKEN and, when a matching Trusted
      # Publisher is configured for the package on npmjs.com, exchanges it
      # for a short-lived publish credential — no NPM_TOKEN needed. The Node
      # 22 image ships npm 10.x, so pin a newer one here.
      - run: npm install -g npm@latest
      - run: pnpm install --frozen-lockfile
      - run: pnpm build
      - name: semantic-release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Attach sigstore provenance to the published tarball.
          NPM_CONFIG_PROVENANCE: "true"
        run: npx semantic-release