release.yml

name: Release Libraries

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
on:
  push:
    branches:
      - main

concurrency: ${{ github.workflow }}-${{ github.ref }}

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      id-token: write
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
          registry-url: 'https://registry.npmjs.org'

      - name: Restore Stencil build cache
        uses: actions/cache@v4
        with:
          path: |
            packages/web-components/.stencil
            node_modules/.cache
          key: stencil-${{ runner.os }}-${{ hashFiles('packages/web-components/src/**/*.tsx', 'packages/web-components/src/**/*.ts', 'packages/web-components/stencil.config.ts', 'pnpm-lock.yaml') }}
          restore-keys: |
            stencil-${{ runner.os }}-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Validate release policy (TD-28)
        run: pnpm validate:release-policy

      # Build all publishable libraries in dependency order (includes new Angular/React/Vue wrappers)
      - name: Build all packages
        run: pnpm build:all

      - name: Create Release PR or Publish
        id: changesets
        uses: changesets/action@v1
        with:
          version: pnpm version-packages
          publish: pnpm release
          title: 'chore: version packages'
          commit: 'chore: version packages'
        env:
          # Use a PAT when repository settings disallow GITHUB_TOKEN-created PRs.
          GITHUB_TOKEN: ${{ secrets.CHANGESETS_TOKEN || secrets.GITHUB_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}