release.yml

name: Release

run-name: Release ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: Existing release tag requiring npm/GitHub publication recovery
        required: true
        type: string

permissions: {}

concurrency:
  group: release-${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref }}
  cancel-in-progress: false

jobs:
  verify:
    name: Verify release commit
    if: github.event_name == 'push'
    uses: ./.github/workflows/ci.yml
    permissions:
      contents: read

  publish:
    name: Publish npm package and GitHub Release
    needs: verify
    if: >-
      always() &&
      ((github.event_name == 'push' && needs.verify.result == 'success') ||
       github.event_name == 'workflow_dispatch')
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: write
      id-token: write

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref }}

      - uses: actions/setup-node@v6
        with:
          node-version: "24"
          registry-url: https://registry.npmjs.org/
          package-manager-cache: false

      - name: Install release npm version
        run: npm install --global npm@11.18.0

      - name: Validate release tag
        id: release
        env:
          RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
        run: node scripts/release.mjs validate "$RELEASE_TAG"

      - name: Check npm registry state
        id: registry
        run: node scripts/release.mjs registry

      - name: Reject an existing version on a new tag
        if: github.event_name == 'push' && steps.registry.outputs.version_exists == 'true'
        run: |
          echo "${{ steps.release.outputs.name }}@${{ steps.release.outputs.version }} is already published" >&2
          exit 1

      - name: Extract release notes
        env:
          RELEASE_VERSION: ${{ steps.release.outputs.version }}
        run: node scripts/release.mjs notes "$RELEASE_VERSION" > "$RUNNER_TEMP/release-notes.md"

      - name: Install dependencies
        run: |
          npm ci
          npm --prefix docs ci

      - name: Install Hugo
        env:
          HUGO_VERSION: 0.146.0
        run: |
          wget -O "$RUNNER_TEMP/hugo.deb" "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_linux-amd64.deb"
          sudo dpkg -i "$RUNNER_TEMP/hugo.deb"

      - name: Build and verify release
        run: |
          npm run release:build
          npm run check
          git diff --exit-code

      - name: Pack exact release artifact
        id: package
        env:
          PACKAGE_NAME: ${{ steps.release.outputs.name }}
          PACKAGE_VERSION: ${{ steps.release.outputs.version }}
        run: |
          mkdir -p release
          npm pack --ignore-scripts --pack-destination release --json > "$RUNNER_TEMP/npm-pack.json"
          node scripts/release.mjs verify-pack "$RUNNER_TEMP/npm-pack.json"
          node --input-type=module <<'NODE'
          import { appendFileSync, readFileSync } from "node:fs";
          const [pack] = JSON.parse(readFileSync(`${process.env.RUNNER_TEMP}/npm-pack.json`, "utf8"));
          appendFileSync(process.env.GITHUB_OUTPUT, `tarball=release/${pack.filename}\n`);
          NODE

      - name: Verify a clean package consumer
        env:
          TARBALL: ${{ steps.package.outputs.tarball }}
        run: npm run check:package-consumer -- "$TARBALL"

      - name: Create or refresh draft GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_NOTES: ${{ runner.temp }}/release-notes.md
          RELEASE_TAG: ${{ steps.release.outputs.tag }}
          TARBALL: ${{ steps.package.outputs.tarball }}
        run: |
          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
            gh release edit "$RELEASE_TAG" --draft --notes-file "$RELEASE_NOTES"
            gh release upload "$RELEASE_TAG" "$TARBALL#npm package tarball" --clobber
          else
            gh release create "$RELEASE_TAG" \
              "$TARBALL#npm package tarball" \
              --draft \
              --notes-file "$RELEASE_NOTES" \
              --verify-tag
          fi

      - name: Publish exact tarball to npm
        if: steps.registry.outputs.version_exists != 'true'
        env:
          NPM_TAG: ${{ steps.release.outputs.npm_tag }}
          TARBALL: ${{ steps.package.outputs.tarball }}
        run: npm publish "./$TARBALL" --access public --tag "$NPM_TAG" --provenance

      - name: Verify the published npm artifact
        run: node scripts/release.mjs verify-registry "$RUNNER_TEMP/npm-pack.json"

      - name: Publish GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          PRERELEASE: ${{ steps.release.outputs.prerelease }}
          RELEASE_TAG: ${{ steps.release.outputs.tag }}
        run: |
          if [[ "$PRERELEASE" == "true" ]]; then
            gh release edit "$RELEASE_TAG" --draft=false --prerelease --latest=false
          else
            gh release edit "$RELEASE_TAG" --draft=false --prerelease=false --latest
          fi