chore: use npm Trusted Publishers and unify release workflow

.github/workflows/release.yml

@@ -6,10 +6,20 @@ on:
     branches: ['main']
     types:
       - completed
+  push:
+    tags:
+      - 'prerelease'
+
+# Trusted Publishers for npm via GitHub Actions OIDC
+permissions:
+  id-token: write
+  contents: write
+  issues: write
+  pull-requests: write
 
 jobs:
   main:
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'push' }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -18,10 +28,11 @@ jobs:
           # fetch full history for lerna version to work
           fetch-depth: 0
 
-      - name: Build
+      - name: Setup node
         uses: actions/setup-node@v4
         with:
           node-version: 22
+          registry-url: 'https://registry.npmjs.org'
 
       - uses: pnpm/action-setup@v3
         name: Install pnpm
@@ -35,46 +46,67 @@ jobs:
           git config --local user.email "[email protected]"
           git config --local user.name "Tolgee Machine"
 
+      - name: Create prerelease branch
+        if: ${{ github.event_name == 'push' }}
+        run: git checkout -b prerelease.$(git rev-parse --short HEAD)
+
       - name: Install
         run: pnpm i
 
       - name: Get next version by semantic-release
+        if: ${{ github.event_name != 'push' }}
         id: version
         run: npx semantic-release --dry-run && echo "VERSION=$(cat .VERSION)" >> $GITHUB_OUTPUT
 
-      - name: Update version locally
-        if: ${{ steps.version.outputs.VERSION != '' }}
+      - name: Update version locally (release)
+        if: ${{ github.event_name != 'push' && steps.version.outputs.VERSION != '' }}
         run: |
           lerna version ${{ steps.version.outputs.VERSION }} --yes --exact --force-publish \
             --no-push --no-git-tag-version
 
+      - name: Update version locally (prerelease)
+        if: ${{ github.event_name == 'push' }}
+        run: |
+          lerna version prerelease --yes --conventional-prerelease --preid prerelease.$(git rev-parse --short HEAD) \
+            --force-publish --no-push --no-git-tag-version --exact
+
       # Set TOLGEE_UI_VERSION for @tolgee/core build
       - name: Set env
-        if: ${{ steps.version.outputs.VERSION != '' }}
+        if: ${{ github.event_name == 'push' || steps.version.outputs.VERSION != '' }}
         run: |
           echo "TOLGEE_UI_VERSION=$(pnpm run --silent ui-version)" >> $GITHUB_ENV
           pnpm run --silent ui-version
 
       - name: Build all packages
-        if: ${{ steps.version.outputs.VERSION != '' }}
+        if: ${{ github.event_name == 'push' || steps.version.outputs.VERSION != '' }}
         run: pnpm build || pnpm build
 
-      - name: Recreate release with push
-        if: ${{ steps.version.outputs.VERSION != '' }}
+      - name: Recreate release with push (release)
+        if: ${{ github.event_name != 'push' && steps.version.outputs.VERSION != '' }}
         run: |
           git stash
           lerna version ${{ steps.version.outputs.VERSION }} --yes --exact --force-publish \
             --create-release github
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - run: echo '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' > ~/.npmrc
+      - name: Recreate release with push (prerelease)
+        if: ${{ github.event_name == 'push' }}
+        run: |
+          git stash
+          git push --follow-tags -u origin $(git rev-parse --abbrev-ref HEAD)
+          lerna version prerelease --yes --conventional-prerelease --preid prerelease.$(git rev-parse --short HEAD) \
+            --force-publish --exact --create-release github
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Publish
-        if: ${{ steps.version.outputs.VERSION != '' }}
+      - name: Publish (release)
+        if: ${{ github.event_name != 'push' && steps.version.outputs.VERSION != '' }}
         run: lerna publish from-package --yes
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish (prerelease)
+        if: ${{ github.event_name == 'push' }}
+        run: lerna publish from-package --yes --dist-tag prerelease
 
       - uses: actions/upload-artifact@v4
         if: always()