release.yml

name: Release

on:
  push:
    tags:
      # `v*` also matches `vscode-v*` (both start with `v`), so exclude the other
      # surfaces' tag prefixes or an extension release would also publish npm.
      - 'v*'
      - '!vscode-v*'
      - '!jetbrains-v*'
  workflow_dispatch:

jobs:
  publish:
    runs-on: ubuntu-latest
    environment: npm-publish
    permissions:
      contents: write # create the GitHub Release for this tag
      id-token: write # required for npm provenance
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - name: Verify release tag is on main
        run: |
          git fetch origin main --quiet
          if ! git merge-base --is-ancestor "${{ github.sha }}" origin/main; then
            echo "::error::Tag ${{ github.ref_name }} (${{ github.sha }}) is not on main; refusing to publish."
            exit 1
          fi
          echo "Release tag ${{ github.ref_name }} is on main; proceeding."
      # npm cannot unpublish, so a mistagged cut is not recoverable.
      - name: Verify tag matches the core version
        if: github.event_name != 'workflow_dispatch'
        env:
          REF_NAME: ${{ github.ref_name }}
        run: |
          TAG_VERSION="${REF_NAME#v}"
          PKG_VERSION="$(node -p "require('./packages/core/package.json').version")"
          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
            echo "::error::Tag ${REF_NAME} does not match packages/core/package.json version ${PKG_VERSION}."
            exit 1
          fi
          echo "Tag matches @asksql/core version ${PKG_VERSION}."
      - uses: pnpm/action-setup@v5
      - uses: actions/setup-node@v5
        with:
          node-version: 22
          cache: pnpm
          registry-url: https://registry.npmjs.org
      - run: pnpm install --frozen-lockfile
      - run: pnpm build
      # `coverage`, not `test`: the floor in vitest.config.ts applies only with --coverage.
      - run: pnpm coverage
      - run: pnpm -r publish --no-git-checks --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_CONFIG_PROVENANCE: 'true'

      - name: Release notes
        id: notes
        run: |
          # %(contents) falls through to the tagged commit for a lightweight tag.
          git fetch --force --tags --quiet
          body=''
          if [ "$(git for-each-ref --format='%(objecttype)' "refs/tags/$GITHUB_REF_NAME")" = 'tag' ]; then
            body="$(git for-each-ref --format='%(contents)' "refs/tags/$GITHUB_REF_NAME")"
          fi
          {
            echo 'body<<ASKSQL_EOF'
            echo "$body"
            echo 'ASKSQL_EOF'
          } >> "$GITHUB_OUTPUT"

      - name: Publish the GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          body: ${{ steps.notes.outputs.body }}
          generate_release_notes: true