release-publish.yml

name: Publish release

# Fires when a release/vX.Y.Z branch (opened by release-prepare.yml) merges
# into main. Tags the merge commit and creates the GitHub Release, using the
# CHANGELOG.md section the PR just merged as the release notes. Merging the
# PR is the only human action required — this completes the release.
on:
  pull_request:
    types: [closed]
    branches: [main]

permissions:
  contents: write

jobs:
  publish:
    if: >
      github.event.pull_request.merged == true &&
      startsWith(github.event.pull_request.head.ref, 'release/v')
    runs-on: ubuntu-latest
    steps:
      - name: Extract version from branch name
        run: |
          HEAD_REF="${{ github.event.pull_request.head.ref }}"
          VERSION="${HEAD_REF#release/v}"
          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "::error::could not parse a semver version from branch '$HEAD_REF'."
            exit 1
          fi
          echo "VERSION=$VERSION" >> "$GITHUB_ENV"

      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ github.event.pull_request.merge_commit_sha }}
          fetch-depth: 0
          fetch-tags: true

      - name: Guard against re-runs
        run: |
          if git rev-parse "v$VERSION" >/dev/null 2>&1; then
            echo "::error::tag v$VERSION already exists — refusing to re-publish."
            exit 1
          fi

      - name: Extract release notes from CHANGELOG.md
        run: |
          node .github/scripts/extract-changelog-section.mjs CHANGELOG.md "$VERSION" > /tmp/release-notes.md
          cat /tmp/release-notes.md

      - name: Tag release commit
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git tag -a "v$VERSION" -m "v$VERSION"
          git push origin "v$VERSION"

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "v$VERSION" \
            --title "v$VERSION" \
            --notes-file /tmp/release-notes.md