release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Version to release, e.g. 2.19.0 or 2.19.0-alpha.1"
        required: true
        type: string

permissions:
  contents: write
  id-token: write

concurrency:
  group: release
  cancel-in-progress: false

jobs:
  release:
    name: Version, tag, and publish
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org/
          cache: pnpm

      - name: Setup npm for trusted publishing
        run: npm install -g npm@11

      - name: Configure Git author
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Ensure release is running from master
        run: |
          if [[ "${GITHUB_REF}" != "refs/heads/master" ]]; then
            echo "Releases must run from master. Current ref: ${GITHUB_REF}"
            exit 1
          fi

      - name: Validate release version
        env:
          VERSION: ${{ inputs.version }}
        run: |
          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then
            echo "Invalid semver version: $VERSION"
            exit 1
          fi

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Create release commit and tag
        env:
          VERSION: ${{ inputs.version }}
        run: |
          pnpm nx release version "$VERSION" --verbose || {
            echo "::group::Release version diagnostics"
            pnpm nx release version "$VERSION" --printConfig || true
            pnpm install --lockfile-only || true
            git status --short || true
            echo "::endgroup::"
            exit 1
          }

      - name: Build packages
        run: pnpm build

      - name: Test packages
        run: pnpm test

      - name: Push release commit and tag
        env:
          VERSION: ${{ inputs.version }}
        run: |
          git push origin HEAD:master
          git push origin "v${VERSION}"

      - name: Publish packages
        run: pnpm nx release publish
        env:
          NPM_CONFIG_PROVENANCE: true