publish.yml

name: Publish

on:
  workflow_run:
    workflows: ["node-es-transformer CI"]
    types:
      - completed
    branches:
      - main
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      target:
        description: "Publish target"
        required: true
        type: choice
        default: dry-run
        options:
          - dry-run
          - npm

concurrency: ${{ github.workflow }}-${{ github.ref }}

jobs:
  release-pr:
    name: Create Release PR
    runs-on: ubuntu-latest
    if: github.event_name == 'workflow_run'
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Check CI Success
        if: ${{ github.event.workflow_run.conclusion != 'success' }}
        run: |
          echo "CI workflow did not succeed. Skipping release."
          exit 1

      - name: Generate GitHub App Token
        id: app-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ vars.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}

      - name: Checkout
        uses: actions/checkout@v6
        with:
          token: ${{ steps.app-token.outputs.token }}
          fetch-depth: 0

      - name: Setup Node.js 22.x
        uses: actions/setup-node@v6
        with:
          node-version: 22.x

      - name: Install dependencies
        run: yarn install --frozen-lockfile

      - name: Build
        run: yarn build

      - name: Check for Changesets
        id: check-changesets
        run: |
          CHANGESET_COUNT=$(find .changeset -name "*.md" ! -name "README.md" 2>/dev/null | wc -l | tr -d ' ')
          if [ "$CHANGESET_COUNT" -gt 0 ]; then
            echo "hasChangesets=true" >> $GITHUB_OUTPUT
            echo "Found $CHANGESET_COUNT changeset(s)"
          else
            echo "hasChangesets=false" >> $GITHUB_OUTPUT
            echo "No changesets found"
          fi

      - name: Create Release Pull Request
        if: steps.check-changesets.outputs.hasChangesets == 'true'
        run: node scripts/create-release-pr.mjs
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
          GITHUB_REPOSITORY: ${{ github.repository }}

      - name: Check for Published Version
        id: check-publish
        if: steps.check-changesets.outputs.hasChangesets == 'false'
        run: |
          VERSION=$(node -p "require('./package.json').version")

          if git ls-remote --tags origin "refs/tags/v${VERSION}" | grep -q "v${VERSION}$"; then
            echo "shouldPublish=false" >> $GITHUB_OUTPUT
            echo "Tag v${VERSION} already exists"
          else
            echo "shouldPublish=true" >> $GITHUB_OUTPUT
            echo "version=${VERSION}" >> $GITHUB_OUTPUT
            echo "Will create release for v${VERSION}"
          fi

      - name: Create GitHub Release
        if: steps.check-publish.outputs.shouldPublish == 'true'
        run: |
          VERSION="${{ steps.check-publish.outputs.version }}"

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          git tag -a "v${VERSION}" -m "Release v${VERSION}"
          git push origin "v${VERSION}"

          RELEASE_NOTES=$(awk '/^## / {if (found) exit; found=1; next} found' CHANGELOG.md)

          gh release create "v${VERSION}" \
            --title "v${VERSION}" \
            --notes "${RELEASE_NOTES}"
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}

  build:
    name: Build package
    runs-on: ubuntu-latest
    if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
    permissions:
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node.js 22.x
        uses: actions/setup-node@v6
        with:
          node-version: 22.x

      - name: Install dependencies
        run: yarn install --frozen-lockfile

      - name: Build
        run: yarn build

      - name: Build tarball
        run: npm pack --silent

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: package
          path: "*.tgz"

  publish-dry-run:
    name: Publish dry run
    runs-on: ubuntu-latest
    needs: build
    if: github.event_name == 'workflow_dispatch' && github.event.inputs.target == 'dry-run'

    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          name: package
          path: dist

      - name: Setup Node.js 22.x
        uses: actions/setup-node@v6
        with:
          node-version: 22.x
          registry-url: https://registry.npmjs.org

      - name: Dry-run publish
        run: npm publish --dry-run ./dist/*.tgz

  publish-npm:
    name: Publish to npm
    runs-on: ubuntu-latest
    needs: build
    if: github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.target == 'npm')
    environment: npm
    permissions:
      contents: read
      id-token: write

    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          name: package
          path: dist

      - name: Setup Node.js 22.x
        uses: actions/setup-node@v6
        with:
          node-version: 22.x
          registry-url: https://registry.npmjs.org

      - name: Upgrade npm for OIDC support
        run: npm install -g npm@latest

      - name: Publish to npm
        run: npm publish --provenance --access public ./dist/*.tgz