release.yml

name: Release

on:
  release:
    types: [published]

permissions:
  contents: read
  id-token: write

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

concurrency:
  group: release-${{ github.event.release.tag_name }}
  cancel-in-progress: false

jobs:
  publish-npm:
    name: Publish npm package
    runs-on: ubuntu-latest
    if: ${{ !github.event.release.prerelease }}

    steps:
      - name: Checkout release tag
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.release.tag_name }}

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org/
          cache: npm

      - name: Update npm
        run: npm install -g npm@latest

      - name: Verify release toolchain
        run: |
          node --version
          npm --version

      - name: Install dependencies
        run: npm ci

      - name: Verify release version
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          node --input-type=module <<'NODE'
          import { readFileSync } from 'node:fs';

          const pkg = JSON.parse(readFileSync('package.json', 'utf8'));
          const expectedTag = `v${pkg.version}`;

          if (process.env.RELEASE_TAG !== expectedTag) {
            throw new Error(`Release tag ${process.env.RELEASE_TAG} does not match package version ${expectedTag}`);
          }
          NODE

      - name: Verify npm version is unpublished
        run: |
          node --input-type=module <<'NODE'
          import { execFileSync } from 'node:child_process';
          import { readFileSync } from 'node:fs';

          const pkg = JSON.parse(readFileSync('package.json', 'utf8'));
          const spec = `${pkg.name}@${pkg.version}`;

          try {
            execFileSync('npm', ['view', spec, 'version'], { stdio: 'pipe' });
          } catch {
            console.log(`${spec} is not published yet`);
            process.exit(0);
          }

          throw new Error(`${spec} is already published on npm`);
          NODE

      - name: Lint
        run: npm run lint -- --quiet

      - name: Typecheck
        run: npm run typecheck

      - name: Test
        run: npm test

      - name: Build
        run: npm run build

      - name: Verify package exports
        run: npm run smoke:exports

      - name: Verify packed package install
        run: npm run smoke:install

      - name: Verify pack boundary
        run: npm run pack:verify

      - name: Publish to npm
        run: npm publish --access public --provenance