release.yml

name: Release

on:
    workflow_run:
        workflows: [CI]
        types: [completed]
        branches: [main]

concurrency:
    group: release
    cancel-in-progress: false

jobs:
    release:
        name: Release
        if: github.event.workflow_run.conclusion == 'success'
        runs-on: ubuntu-latest
        timeout-minutes: 5
        permissions:
            contents: write
            pull-requests: write
            id-token: write
        steps:
            - uses: actions/checkout@v6
              with:
                  ref: ${{ github.event.workflow_run.head_sha }}
            - uses: ./.github/actions/setup-bun

            - name: Create release PR
              id: changesets
              uses: changesets/action@v1
              with:
                  version: bun run version
                  title: "chore: version packages"
                  commit: "chore: version packages"
              env:
                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

            - name: Check if release needed
              id: check-release
              if: steps.changesets.outputs.hasChangesets == 'false'
              run: |
                  VERSION=$(jq -r '.version' package.json)
                  TAG="v${VERSION}"

                  if git ls-remote --exit-code --tags origin "refs/tags/$TAG" &>/dev/null; then
                    echo "Tag $TAG already exists on remote, skipping"
                    echo "should_release=false" >> "$GITHUB_OUTPUT"
                  else
                    echo "should_release=true" >> "$GITHUB_OUTPUT"
                    echo "tag=$TAG" >> "$GITHUB_OUTPUT"
                  fi

            - name: Detect pre-release
              id: pre-release
              if: steps.check-release.outputs.should_release == 'true'
              run: |
                  if [ -f ".changeset/pre.json" ]; then
                    echo "npm_tag=$(jq -r '.tag' .changeset/pre.json)" >> "$GITHUB_OUTPUT"
                    echo "is_pre=true" >> "$GITHUB_OUTPUT"
                  else
                    echo "npm_tag=latest" >> "$GITHUB_OUTPUT"
                    echo "is_pre=false" >> "$GITHUB_OUTPUT"
                  fi

            - name: Build
              if: steps.check-release.outputs.should_release == 'true'
              run: bun run build

            # Node required for npm publish --provenance (OIDC-based trusted publishing)
            - uses: ./.github/actions/setup-node
              if: steps.check-release.outputs.should_release == 'true'

            - name: Publish to npm
              if: steps.check-release.outputs.should_release == 'true'
              run: npm publish --provenance --tag ${{ steps.pre-release.outputs.npm_tag }}

            - name: Create GitHub Release
              if: steps.check-release.outputs.should_release == 'true'
              run: |
                  TAG="${{ steps.check-release.outputs.tag }}"
                  FLAGS=(--generate-notes --title "$TAG" --target "${{ github.event.workflow_run.head_sha }}")

                  if [ "${{ steps.pre-release.outputs.is_pre }}" = "true" ]; then
                    FLAGS+=(--prerelease)
                  fi

                  gh release create "$TAG" "${FLAGS[@]}"
              env:
                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}