release.yml

name: Release

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: write # push the version commit/tags and create GitHub releases
  pull-requests: write # open/update the version PR
  id-token: write # npm trusted publishing (OIDC)

concurrency:
  group: release
  cancel-in-progress: false

jobs:
  release:
    name: Version or publish
    runs-on: ubuntu-latest
    if: github.repository == 'b10cks/sdk'
    env:
      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0

      - uses: ./.github/actions/setup

      # Publishing uses npm trusted publishing (OIDC) — no token needed.
      # The NPM_TOKEN secret is only a fallback for packages that do not have a
      # trusted publisher configured on npmjs.com yet.
      - name: Configure npm token fallback
        if: env.NPM_TOKEN != ''
        run: |
          echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" >> ~/.npmrc

      - name: Create version PR or publish
        id: changesets
        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
        with:
          version: pnpm run changeset:version
          publish: pnpm run release
          commit: '🔖 Version packages'
          title: '🔖 Version packages'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Summary
        if: always()
        run: |
          if [ "${{ steps.changesets.outputs.published }}" = "true" ]; then
            echo "### Published" >> "$GITHUB_STEP_SUMMARY"
            echo '${{ steps.changesets.outputs.publishedPackages }}' \
              | node -e 'let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{for(const p of JSON.parse(d))console.log(`- \`${p.name}@${p.version}\``)})' \
              >> "$GITHUB_STEP_SUMMARY"
          elif [ -n "${{ steps.changesets.outputs.pullRequestNumber }}" ]; then
            echo "Version PR #${{ steps.changesets.outputs.pullRequestNumber }} created/updated." >> "$GITHUB_STEP_SUMMARY"
          else
            echo "Nothing to release." >> "$GITHUB_STEP_SUMMARY"
          fi