release.yml

name: Release

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      version:
        description: 'Exact version to release (e.g. 1.2.3). Leave empty to auto-bump.'
        required: false
        type: string
      preid:
        description: 'Pre-release identifier (e.g. beta, rc). Optional'
        required: false
        type: string
      npm_tag:
        description: 'npm dist-tag (e.g. latest, beta)'
        required: false
        default: 'latest'
        type: string

permissions:
  contents: read

jobs:
  policy:
    name: Release policy
    if: >-
      github.ref == 'refs/heads/main' &&
      github.actor != format('{0}[bot]', vars.RELEASE_APP_SLUG)
    runs-on: ubuntu-24.04
    outputs:
      should_release: ${{ steps.policy.outputs.should_release }}
    steps:
      - name: Checkout trusted workflow revision
        uses: actions/checkout@v7.0.1
        with:
          ref: ${{ github.workflow_sha }}
          persist-credentials: false

      - name: Check release event
        id: policy
        env:
          RELEASE_APP_SLUG: ${{ vars.RELEASE_APP_SLUG }}
        run: node .github/scripts/releaseAutomation.cjs policy >> "$GITHUB_OUTPUT"

  ci:
    name: CI
    needs: policy
    if: needs.policy.outputs.should_release == 'true'
    uses: ./.github/workflows/ci.yml
    with:
      full: true

  release:
    name: Release & Publish
    runs-on: ubuntu-24.04
    needs: [policy, ci]
    if: needs.policy.outputs.should_release == 'true'
    environment: release
    permissions:
      contents: write
      id-token: write
    steps:
      - name: Create release App token
        id: release-app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ vars.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
          # Omitting owner/repositories scopes the token to this repository only.
          permission-contents: write

      - name: Checkout repository
        uses: actions/checkout@v7.0.1
        with:
          fetch-depth: 0
          fetch-tags: true
          token: ${{ steps.release-app-token.outputs.token }}

      - name: Use Node.js
        uses: actions/setup-node@v7.0.0
        with:
          node-version: 24
          cache: 'npm'

      - name: Update npm
        run: |
          npm install -g npm@11.7.0
          npm -v

      - name: Install dependencies
        run: npm ci

      - name: Configure Git user
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Run release-it
        env:
          DEBUG: release-it:*,@release-it/*
          HUSKY: 0
          GITHUB_TOKEN: ${{ steps.release-app-token.outputs.token }}
          RELEASE_APP_SLUG: ${{ vars.RELEASE_APP_SLUG }}
          RELEASE_TOKEN_APP_SLUG: ${{ steps.release-app-token.outputs.app-slug }}
          RELEASE_VERSION: ${{ inputs.version }}
          RELEASE_PREID: ${{ inputs.preid }}
          RELEASE_NPM_TAG: ${{ inputs.npm_tag }}
        run: node .github/scripts/releaseAutomation.cjs run

      - name: Sync main → develop
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            await github.rest.repos.merge({
              ...context.repo,
              base: "develop",
              head: "main",
              commit_message: "chore(sync): merge main into develop",
            });