release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  verify:
    name: Verify package
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      tarball: ${{ steps.pack.outputs.tarball }}
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "24.x"
          package-manager-cache: false

      - name: Install dependencies
        run: npm ci

      - name: Verify tag matches package version
        run: |
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          PACKAGE_VERSION="$(node -p "JSON.parse(require('fs').readFileSync('package.json', 'utf8')).version")"
          test "$TAG_VERSION" = "$PACKAGE_VERSION"

      - name: Check committed dist artifacts
        run: npm run check:dist

      - name: Check generated artifacts
        run: npm run check:generated

      - name: Lint
        run: npm run lint

      - name: Check formatting
        run: npm run format:check

      - name: Run tests
        run: npm test

      - name: Verify package contents
        id: pack
        run: |
          PACK_JSON="$(npm pack --json)"
          printf '%s\n' "$PACK_JSON"
          TARBALL="$(node -e "const data = JSON.parse(process.argv[1]); console.log(data[0].filename)" "$PACK_JSON")"
          echo "tarball=$TARBALL" >> "$GITHUB_OUTPUT"

      - name: Upload npm package artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: npm-package
          path: ${{ steps.pack.outputs.tarball }}
          if-no-files-found: error
          retention-days: 7

  publish:
    name: Publish package
    needs: verify
    runs-on: ubuntu-latest
    environment: npm-publish
    permissions:
      contents: read
    steps:
      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "24.x"
          registry-url: "https://registry.npmjs.org"
          package-manager-cache: false

      - name: Download npm package artifact
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          name: npm-package

      - name: Publish to npm
        run: npm publish *.tgz --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

  github-release:
    name: Create GitHub Release
    needs: publish
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Extract version from tag
        id: version
        run: echo "VERSION=${GITHUB_REF#refs/tags/v}" >> "$GITHUB_OUTPUT"

      - name: Extract release notes from CHANGELOG
        id: changelog
        env:
          VERSION: ${{ steps.version.outputs.VERSION }}
        run: |
          # VERSION is bound via env (above) rather than interpolated into the
          # shell, so a crafted tag name cannot break out of the string.
          # Extract section for this version from CHANGELOG.md: everything between
          # ## [VERSION] and the next section heading or the trailing link-definition block
          NOTES=$(awk -v ver="$VERSION" '$0 ~ "^## \\["ver"\\]" {flag=1; next} /^## \[|^\[Unreleased\]:/ {flag=0} flag' CHANGELOG.md)
          if [ -z "$NOTES" ]; then
            NOTES="Release v$VERSION"
          fi
          # Use delimiter for multi-line output
          echo "NOTES<<EOF" >> "$GITHUB_OUTPUT"
          echo "$NOTES" >> "$GITHUB_OUTPUT"
          echo "EOF" >> "$GITHUB_OUTPUT"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
        with:
          body: ${{ steps.changelog.outputs.NOTES }}
          draft: false
          prerelease: ${{ contains(steps.version.outputs.VERSION, '-') }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}