main.yml

name: Main Checks

on:
  push:
    branches:
      - main

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read # to fetch code (actions/checkout)

jobs:
  prepare-npm-cache-ubuntu:
    uses: ./.github/workflows/prepare-cache.yml
    with:
      os: ubuntu-latest

  lint:
    uses: ./.github/workflows/lint.yml
    needs: prepare-npm-cache-ubuntu

  test-ubuntu:
    uses: ./.github/workflows/test.yml
    needs: prepare-npm-cache-ubuntu
    with:
      os: ubuntu-latest

  release:
    name: Release
    runs-on: ubuntu-latest
    needs:
      - test-ubuntu
      - lint
    permissions:
      contents: write # to be able to publish a GitHub release
      issues: write # to be able to comment on released issues
      pull-requests: write # to be able to comment on released pull requests
      id-token: write # to enable use of OIDC for npm provenance
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          persist-credentials: false
      - name: Install pnpm
        uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
      - run: pnpm install --prefer-offline --frozen-lockfile
      - run: pnpm audit signatures
      - uses: changesets/action@v1
        with:
          publish: pnpm run release
          title: "chore(release): version packages"
          commit: "chore(release): version packages"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}