release.yml

name: Release

on:
  push:
    branches: [main]

concurrency: ${{ github.workflow }}-${{ github.ref }}

permissions:
  contents: write
  pull-requests: write
  issues: write
  repository-projects: write
  id-token: write # Required for npm OIDC trusted publishing

jobs:
  release:
    name: Release
    # Must use a GitHub-hosted runner — npm OIDC trusted publishing does not
    # support self-hosted runners (including Namespace) at this time.
    # https://docs.npmjs.com/trusted-publishers/
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}

      - name: Install pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '24'
          cache: 'pnpm'

      - name: Update npm
        # npm 11.5.1+ is required for OIDC trusted publishing support.
        # Pin to 11.x: npm 12.0.0 ships a broken bundle missing the `sigstore`
        # module in libnpmpublish, which breaks `publish --provenance` with
        # "Cannot find module 'sigstore'".
        run: npm install -g npm@11

      - name: Install dependencies
        run: pnpm install --ignore-scripts

      - name: Build packages
        run: pnpm build

      - name: Create Release Pull Request or Publish to npm
        id: changesets
        uses: changesets/action@v1
        with:
          # --provenance generates signed attestations linking each package
          # to this workflow run. Automatically enabled when using trusted
          # publishers, but explicit here for clarity.
          publish: pnpm changeset publish --provenance
          title: "Version Packages"
          commit: "Version Packages"
        env:
          GITHUB_TOKEN: ${{ secrets.CHANGESET_TOKEN || secrets.GITHUB_TOKEN }}
          # TODO: once every package has a trusted publisher configured on
          # npmjs.com, remove NPM_TOKEN entirely. For now it acts as a
          # fallback for packages not yet configured.
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}