release.yml

name: Release

# Manual release: run from the Actions tab (or `gh workflow run release.yml -f bump=patch`).
# Publishes to npm with provenance via OIDC trusted publishing — no NPM_TOKEN secret.
# One-time per package: npmjs.com -> package -> Settings -> Trusted Publisher -> GitHub Actions.

on:
  workflow_dispatch:
    inputs:
      bump:
        description: "Semver bump"
        required: true
        default: "patch"
        type: choice
        options:
          - patch
          - minor
          - major

permissions:
  contents: write
  id-token: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 22
          registry-url: "https://registry.npmjs.org"
      - name: Upgrade npm (OIDC trusted publishing needs npm >= 11.5; pin 11)
        run: npm install -g npm@11
      - name: Install
        run: npm ci || npm install
      - run: npm run build --if-present
      - run: npm test
      - name: Configure git identity
        run: |
          git config user.name "Mark Stuart"
          git config user.email "742884+mstuart@users.noreply.github.com"
      - name: Bump version and tag
        id: bump
        run: |
          tag=$(npm version ${{ inputs.bump }} -m 'chore(release): %s')
          echo "tag=$tag" >> "$GITHUB_OUTPUT"
      - name: Push commit and tag
        run: |
          git push origin "HEAD:${{ github.ref_name }}"
          git push origin "${{ steps.bump.outputs.tag }}"
      - name: Publish to npm (provenance, OIDC — no token)
        run: npm publish --provenance --access public
      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release create "${{ steps.bump.outputs.tag }}" --title "${{ steps.bump.outputs.tag }}" --generate-notes