release.yml

name: Release

on:
  release:
    types:
      - published

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write

    steps:
      - name: Check out repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          fetch-depth: 0

      - name: Set up pnpm
        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
        with:
          standalone: true
          run_install: false

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 24.18.0
          registry-url: https://registry.npmjs.org
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Derive release version from tag
        id: release_version
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          VERSION="${RELEASE_TAG#v}"
          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
            echo "Release tag '$RELEASE_TAG' is not a valid semver tag."
            exit 1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "PLUGIN_VERSION=$VERSION" >> "$GITHUB_ENV"

      - name: Stamp package version from tag
        env:
          RELEASE_VERSION: ${{ steps.release_version.outputs.version }}
        run: npm pkg set version="$RELEASE_VERSION"

      - name: Typecheck
        run: pnpm typecheck

      - name: Test
        run: pnpm test

      - name: Build
        env:
          PLUGIN_VERSION: ${{ steps.release_version.outputs.version }}
        run: pnpm build

      - name: Publish to npm
        env:
          PLUGIN_VERSION: ${{ steps.release_version.outputs.version }}
        run: npm publish --access public --provenance

      - name: Sync checked-in package version to release branch
        env:
          RELEASE_VERSION: ${{ steps.release_version.outputs.version }}
          RELEASE_TARGET_BRANCH: ${{ github.event.release.target_commitish }}
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        run: |
          set -euo pipefail

          TARGET_BRANCH="${RELEASE_TARGET_BRANCH:-$DEFAULT_BRANCH}"

          if ! git ls-remote --exit-code --heads origin "$TARGET_BRANCH" >/dev/null 2>&1; then
            echo "Release target '$TARGET_BRANCH' is not a branch on origin; skipping package.json sync."
            exit 0
          fi

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git fetch origin "$TARGET_BRANCH"
          git switch --create "release-version-sync-$RELEASE_VERSION" "origin/$TARGET_BRANCH"
          npm pkg set version="$RELEASE_VERSION"

          if git diff --quiet -- package.json; then
            echo "package.json already matches $RELEASE_VERSION on $TARGET_BRANCH."
            exit 0
          fi

          git add package.json
          git commit -m "chore: sync package version to $RELEASE_VERSION"
          git push origin HEAD:"$TARGET_BRANCH"