release.yml

name: Release

# 手动触发发布，通过 npm OIDC trusted publishing 发布（无需 NPM_TOKEN）
on:
  workflow_dispatch:
    inputs:
      version_type:
        description: 'Version bump type'
        required: true
        default: 'patch'
        type: choice
        options:
          - patch
          - minor
          - major
      dry_run:
        description: 'Dry run (do not publish or push)'
        required: false
        default: false
        type: boolean

permissions:
  contents: write   # push the version bump commit + tag, create the GitHub release
  id-token: write   # npm OIDC trusted publishing

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    # 避免并发触发的两次发布互相踩踏，且不取消进行中的发布
    concurrency:
      group: release-${{ github.ref }}
      cancel-in-progress: false
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24
          registry-url: 'https://registry.npmjs.org'

      # OIDC trusted publishing requires npm >= 11.5.1
      - name: Upgrade npm
        run: npm install -g npm@latest

      - name: Install dependencies
        run: npm i --no-package-lock --no-fund

      - name: Test
        run: npm test

      - name: Configure Git
        run: |
          git config --local user.email "github-actions[bot]@users.noreply.github.com"
          git config --local user.name "github-actions[bot]"

      - name: Version bump
        id: bump
        if: ${{ github.event.inputs.dry_run != 'true' }}
        run: |
          npm version ${{ github.event.inputs.version_type }} -m "Release v%s"
          echo "tag=v$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT"

      - name: Publish (dry run)
        if: ${{ github.event.inputs.dry_run == 'true' }}
        run: npm publish --provenance --dry-run

      # Publish before pushing: if publish fails, nothing is pushed and the
      # run can be retried cleanly without a double version bump.
      - name: Publish
        if: ${{ github.event.inputs.dry_run != 'true' }}
        run: npm publish --provenance

      - name: Push commit and tag
        if: ${{ github.event.inputs.dry_run != 'true' }}
        run: git push origin HEAD:${{ github.ref_name }} --follow-tags

      - name: Create GitHub Release
        if: ${{ github.event.inputs.dry_run != 'true' }}
        run: gh release create "${{ steps.bump.outputs.tag }}" --verify-tag --generate-notes
        env:
          GITHUB_TOKEN: ${{ github.token }}