release.yml

name: Release & Publish

on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: write
  id-token: write

jobs:
  release:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.3.8"

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"
          cache: npm

      - name: Show Node and npm versions
        run: |
          node --version
          npm --version

      - name: Ensure latest npm for Trusted Publishing
        run: npm install -g npm@latest

      - name: Install dependencies
        run: npm ci

      - name: Run checks
        run: npm run check

      - name: Verify tag and package.json version match
        shell: bash
        run: |
          PKG_VERSION=$(node -p "require('./package.json').version")
          TAG_VERSION="${GITHUB_REF_NAME#v}"

          if [[ "$PKG_VERSION" != "$TAG_VERSION" ]]; then
            echo "Tag version (v$TAG_VERSION) does not match package.json version ($PKG_VERSION)."
            exit 1
          fi

      - name: Publish package to npm (Trusted Publishing)
        run: npm publish --access public --provenance

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true