release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Existing release tag to publish, such as v0.1.0"
        required: true
        type: string

permissions:
  contents: write
  id-token: write

jobs:
  publish-release:
    name: Publish package
    runs-on: ubuntu-latest
    env:
      RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
    steps:
      - name: Checkout release tag
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ env.RELEASE_TAG }}

      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 24
          cache: npm
          registry-url: "https://registry.npmjs.org"

      - name: Validate package version matches tag
        run: |
          PACKAGE_VERSION="$(node -p "require('./package.json').version")"
          if [ "v${PACKAGE_VERSION}" != "${RELEASE_TAG}" ]; then
            echo "package.json version ${PACKAGE_VERSION} does not match tag ${RELEASE_TAG}" >&2
            exit 1
          fi

      - name: Install dependencies
        run: npm ci

      - name: Typecheck
        run: npm run typecheck

      - name: Test
        run: npm test

      - name: Build
        run: npm run build

      - name: Pack
        id: pack
        run: |
          npm pack --json > pack.json
          TARBALL="$(node -e "console.log(JSON.parse(require('node:fs').readFileSync('pack.json', 'utf8'))[0].filename)")"
          echo "tarball=${TARBALL}" >> "$GITHUB_OUTPUT"

      - name: Publish to npm
        run: npm publish "${{ steps.pack.outputs.tarball }}" --access public

      - name: Ensure GitHub Release exists
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if ! gh release view "${RELEASE_TAG}" >/dev/null 2>&1; then
            gh release create "${RELEASE_TAG}" --verify-tag --generate-notes --title "${RELEASE_TAG}"
          fi

      - name: Attach package tarball to GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release upload "${RELEASE_TAG}" "${{ steps.pack.outputs.tarball }}" --clobber