release.yml

name: Manual release
on:
  workflow_dispatch:

permissions:
  contents: write
  # Needed to dispatch the publish workflow at the end of the release job.
  actions: write

jobs:
  release:
    name: Run commit-and-tag-version, push to main, and create GitHub release
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository (full history)
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          persist-credentials: true

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '24'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Configure git identity
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Run commit-and-tag-version and push commit + tags to main
        env:
          # GITHUB_TOKEN is available if no push_token was provided; if a PAT was provided we already rewrote the remote.
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Prefer npx so this works whether the package is in the repo or not.
          # If your repo already contains commit-and-tag-version as a dependency, this will run the local binary.
          echo "Running commit-and-tag-version..."
          npx commit-and-tag-version

          # After the tool creates the new version commit and tag locally, push commit and tags to main.
          # Ensure we push HEAD to main in case the workflow is running from a different ref.
          echo "Pushing commit and tags to main..."
          git push origin HEAD:main --follow-tags

      - name: Resolve release tag and notes
        id: release
        run: |
          tag="v$(node -p "JSON.parse(require('fs').readFileSync('package.json', 'utf8')).version")"
          version="${tag#v}"

          awk -v version="$version" '
            $0 ~ "^## \\[" version "\\]" { in_section=1; next }
            in_section && $0 ~ "^## \\[" { exit }
            in_section { print }
          ' CHANGELOG.md > RELEASE_NOTES.md

          if [ ! -s RELEASE_NOTES.md ]; then
            printf 'Release %s\n' "$tag" > RELEASE_NOTES.md
          fi

          echo "tag=$tag" >>"$GITHUB_OUTPUT"

      - name: Create or update GitHub release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ steps.release.outputs.tag }}
        run: |
          if gh release view "$TAG" >/dev/null 2>&1; then
            gh release edit "$TAG" --title "$TAG" --notes-file RELEASE_NOTES.md
          else
            gh release create "$TAG" --title "$TAG" --notes-file RELEASE_NOTES.md
          fi

      # Releases created with the default GITHUB_TOKEN do not trigger the
      # `release: published` event in other workflows (GitHub's recursion
      # guard), so the publish workflow must be dispatched explicitly.
      # workflow_dispatch is exempt from that guard.
      - name: Trigger npm publish workflow
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ steps.release.outputs.tag }}
        run: gh workflow run publish.yml --ref main -f tag="$TAG"