release.yml

name: Release (Manual)

# Manual fallback publish — use only for emergency hotfixes.
# Normal releases are handled automatically by the release-please.yml workflow.

on:
  workflow_dispatch:
    inputs:
      confirm:
        description: 'Type "publish" to confirm manual release'
        required: true
        type: string

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

defaults:
  run:
    shell: bash

jobs:
  publish:
    name: Publish npm package (manual)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    if: inputs.confirm == 'publish'
    environment: npm
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Generate GitHub App Token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}

      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          token: ${{ steps.app-token.outputs.token }}
          fetch-depth: 0

      - name: Setup pnpm
        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v4.1.0

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          registry-url: 'https://registry.npmjs.org'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Upgrade npm for trusted publishing
        run: |
          npm install --global npm@^11.5.1
          npm --version

      - name: Verify branch is main
        run: |
          if [[ "${{ github.ref }}" != "refs/heads/main" ]]; then
            echo "Manual publish must run from main branch, got: ${{ github.ref }}"
            exit 1
          fi

      - name: Build package
        run: pnpm --filter @dallay/astro-icon run build

      - name: Publish package
        working-directory: packages/core
        run: pnpm publish --access public --no-git-checks
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}