release.yml

name: Release

on:
  push:
    branches:
      - main

concurrency: ${{ github.workflow }}-${{ github.ref }}

permissions:
  contents: write
  pull-requests: write

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repo
        uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
          registry-url: 'https://registry.npmjs.org'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build
        run: pnpm build

      - name: Typecheck
        run: pnpm typecheck

      - name: Test
        run: pnpm test

      - name: Create release PR or publish to npm
        id: changesets
        uses: changesets/action@v2
        with:
          publish-script: pnpm release
          github-token: ${{ secrets.GITHUB_TOKEN }}
          create-github-releases: true
          push-git-tags: true
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

  # The extension is private (never published to npm); its release artifact is
  # a signed crx attached to the GitHub release of its changesets tag. The
  # called workflow checks by itself whether the current version needs packing,
  # so no gating on changesets outputs is required here.
  browser-extension:
    name: Release Browser Extension
    needs: release
    uses: ./.github/workflows/release-extension.yml
    secrets: inherit

  # Same pattern for the lanhu-monkey userscript: its artifact is a plain
  # .user.js attached to the release of its own changesets tag.
  lanhu-monkey:
    name: Release Userscript
    needs: release
    uses: ./.github/workflows/release-userscript.yml
    secrets: inherit