publish-github-release.yml

name: Publish GitHub Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Existing vX.Y.Z tag to publish"
        required: true
        type: string

jobs:
  publish-release:
    runs-on: ubuntu-latest

    permissions:
      contents: write

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          ref: ${{ github.event.inputs.tag || github.ref }}

      - name: Set up pnpm
        uses: pnpm/action-setup@8912a9102ac27614460f54aedde9e1e7f9aec20d # v6.0.5
        with:
          run_install: false

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Resolve release tag
        id: resolve_tag
        shell: bash
        run: |
          TAG="${{ github.event.inputs.tag || github.ref_name }}"
          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
          echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"

      - name: Check version drift
        run: pnpm version:check

      - name: Check tracked installer artifacts
        run: pnpm guard:installer-artifacts

      - name: Render release notes
        run: pnpm release:notes -- "${{ steps.resolve_tag.outputs.version }}" --output release-notes.md

      - name: Publish release
        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
        with:
          tag_name: ${{ steps.resolve_tag.outputs.tag }}
          name: ${{ steps.resolve_tag.outputs.tag }}
          body_path: release-notes.md
          generate_release_notes: false