feat(plugin-clean)!: initial release (#442) #668

	name: Release Projects

	on:
	workflow_dispatch:
	push:
	branches:
	- main
	tags-ignore:
	- '-v'

	permissions:
	# Jobs requiring OIDC (e.g., npm publish) must request `id-token: write` at the job level.
	contents: read
	pages: write

	jobs:
	release:
	if: \|
	!startsWith(github.event.head_commit.message, 'chore(release):') &&
	!startsWith(github.event.head_commit.message, 'chore(repo):')

	permissions:
	# Required for `versioner` to push release commits/tags and for npm OIDC publish.
	contents: write
	id-token: write

	runs-on: ubuntu-latest

	name: release

	steps:
	- name: Checkout Commit
	uses: actions/checkout@v4
	with:
	fetch-depth: 100
	fetch-tags: true
	ref: main
	token: ${{ secrets.GH_TOKEN }}

	- name: Fetch Tags
	run: git fetch --tags

	- name: Set Git Config
	run: \|
	git config pull.rebase false
	git config --global user.email "release-workflow@jsx.email"
	git config --global user.name "Release Workflow"
	git remote set-url origin https://github.com/${{ github.repository }}

	- name: Setup
	uses: ./.github/actions/setup

	- name: Build Projects
	run: \|
	moon jsx-email:build
	moon create-mail:build
	moon run :build --query "project~plugin-*"

	- name: OIDC Preflight
	shell: bash
	run: \|
	if [ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ] \|\| [ -z "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" ]; then
	echo "Missing GitHub Actions OIDC env vars (ACTIONS_ID_TOKEN_REQUEST_URL/TOKEN)." >&2
	echo "Ensure the job requests permissions: id-token: write." >&2
	exit 1
	fi

	echo "OIDC env vars detected."

	- name: Release
	run: moon run :release --affected --concurrency 1 --remote

Provide feedback