release.yml

name: Release

# Runs after a PR is merged (i.e. a push lands on main). semantic-release
# analyses the conventional commits since the last release, computes the next
# version, updates package.json + CHANGELOG.md, tags the commit, and pushes a
# "chore(release): x.y.z" commit back as semantic-release-bot.
on:
  push:
    branches: [main]

# Required so semantic-release can open the GitHub Release. The push of the
# release commit to main uses GH_PAT (below), not the built-in token, because
# the built-in GITHUB_TOKEN cannot bypass the "require a pull request" rule.
permissions:
  contents: write
  issues: write
  pull-requests: write

# Never run more than one release at a time.
concurrency:
  group: release
  cancel-in-progress: false

jobs:
  release:
    name: semantic-release
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          # Full history + tags are required for commit analysis.
          fetch-depth: 0
          # Don't leave the built-in GITHUB_TOKEN configured as the push
          # credential — semantic-release must push with GH_PAT so it can
          # bypass the branch ruleset.
          persist-credentials: false

      - name: Release
        uses: cycjimmy/semantic-release-action@v4
        with:
          # Plugins beyond the ones bundled with semantic-release.
          extra_plugins: |
            @semantic-release/changelog
            @semantic-release/git
        env:
          # GH_PAT must be a token whose owner/app is on the main ruleset's
          # bypass list, so @semantic-release/git can push the release commit.
          # Falls back to GITHUB_TOKEN if unset (release will then fail the
          # push until GH_PAT is configured — see README "CI & releases").
          GITHUB_TOKEN: ${{ secrets.GH_PAT || secrets.GITHUB_TOKEN }}