release.yml

name: Release

# The filename is load-bearing: npm's trusted publisher for this package
# matches on repo + workflow filename, so renaming this file means updating the
# publisher first.

on:
  schedule:
    - cron: '0 9 * * 1' # Every Monday at 9:00 AM UTC
  workflow_dispatch:

permissions:
  contents: write
  id-token: write
  pull-requests: read

concurrency:
  group: ${{ github.workflow }}

jobs:
  release:
    runs-on: ubuntu-latest
    # The cron only ever fires on the default branch, but a manual dispatch can
    # target any branch. Without this guard, dispatching against a version
    # branch would bump, tag and publish that branch to npm as latest.
    if: github.ref_name == github.event.repository.default_branch

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: '.nvmrc'

      # Load-bearing: this package has no prepublishOnly, so the dist/ that gets
      # published is the one `npm test` builds, and the tests gate the release.
      - run: npm ci

      - run: npm test

      - uses: tanem/release-action@29ffc8b4e3956c1b9532bfb2ad863f31953354a4 # v0.1.0