release.yml

name: Release

# Manual release: run from the Actions tab (or `gh workflow run release.yml -f bump=patch`).
# Publishes to npm with provenance via OIDC trusted publishing — no NPM_TOKEN secret.
# One-time per package: protect the `npm-release` GitHub environment with required reviewers,
# then configure it in npmjs.com -> package -> Settings -> Trusted Publisher -> GitHub Actions.

on:
  workflow_dispatch:
    inputs:
      bump:
        description: 'Semver bump'
        required: true
        default: 'patch'
        type: choice
        options:
          - patch
          - minor
          - major

permissions: {}

jobs:
  release:
    if: github.ref == 'refs/heads/main'
    environment: npm-release
    permissions:
      contents: write
      id-token: write
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22
          registry-url: 'https://registry.npmjs.org'
      - name: Upgrade npm (OIDC trusted publishing needs npm >= 11.5; pin 11)
        run: npm install -g npm@11
      - name: Install
        run: npm ci
      - run: npm run lint
      - run: npm run typecheck
      - run: npm test
      - run: npm run test:coverage:check
      - run: npm run build
      - name: Configure git identity
        run: |
          git config user.name "Mark Stuart"
          git config user.email "742884+mstuart@users.noreply.github.com"
      - name: Bump version and tag
        id: bump
        run: |
          tag=$(npm version ${{ inputs.bump }} -m 'chore(release): %s')
          echo "tag=$tag" >> "$GITHUB_OUTPUT"
      - name: Push commit and tag
        run: |
          git push origin "HEAD:${{ github.ref_name }}"
          git push origin "${{ steps.bump.outputs.tag }}"
      - name: Publish to npm (provenance, OIDC — no token)
        run: npm publish --provenance --access public
      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release create "${{ steps.bump.outputs.tag }}" --title "${{ steps.bump.outputs.tag }}" --generate-notes