release.yml

name: Release
on:
  push:
    branches:
      - main

# Set proper permissions for GITHUB_TOKEN
permissions:
  contents: write      # to create release/tag (semantic-release)
  issues: write        # to create issues
  pull-requests: write # to create pull requests
  packages: write      # to publish packages

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
          # Don't use persist-credentials: false, it causes issues
          
      - name: Setup Node.js
        uses: actions/setup-node@v3
        with:
          node-version: '18.x'
          registry-url: 'https://registry.npmjs.org'
          
      - name: Install dependencies
        run: npm ci
        
      - name: Build
        run: npm run build
        
      - name: Install ESLint
        run: npm install --no-save eslint @typescript-eslint/eslint-plugin @typescript-eslint/parser
        
      - name: Lint and fix
        run: npx eslint --fix . --ext .ts
        
      - name: Test
        run: npm test
        
      - name: Release
        env:
          # Use the default GITHUB_TOKEN with proper permissions set at workflow level
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          # Configure Git user
          git config --global user.name "github-actions[bot]"
          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
          # Run semantic-release
          npx semantic-release