release.yml

name: Release
run-name: Release ${{ inputs.version }}
on:
  workflow_dispatch:
    inputs:
      version:
        description: "Release version (e.g. v1.2.3)"
        required: true
        type: string

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest
    env:
      VERSION: ${{ inputs.version }}
    steps:
      - name: Validate version input
        run: |
          if ! echo "$VERSION" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
            echo "::error::Invalid version: $VERSION (expected vX.Y.Z)"
            exit 1
          fi

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Ensure tag does not exist
        run: |
          if git rev-parse --verify --quiet "refs/tags/$VERSION" >/dev/null; then
            echo "::error::Tag $VERSION already exists."
            exit 1
          fi

      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24.x
          cache: npm
      # Dependency install scripts must not run in a job with a contents:write token
      - run: npm ci --ignore-scripts
      - run: npm test
      - run: npm run build
      - run: npm run package

      - name: Verify dist/ is up to date
        run: |
          if [ "$(git diff --ignore-space-at-eol --text dist/ | wc -l)" -gt "0" ]; then
            echo "::error::dist/ is out of date. Aborting release."
            exit 1
          fi

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          SHA: ${{ github.sha }}
        run: |
          PREV_TAG=$(git tag --list 'v[0-9]*.[0-9]*.[0-9]*' --sort=-v:refname | head -n 1)
          if [ -n "$PREV_TAG" ]; then
            gh release create "$VERSION" --target "$SHA" --generate-notes --notes-start-tag "$PREV_TAG"
          else
            gh release create "$VERSION" --target "$SHA" --generate-notes
          fi

      - name: Update major version tag
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          MAJOR=$(echo "$VERSION" | cut -d. -f1)
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git tag -fa "$MAJOR" -m "Update $MAJOR tag to $VERSION"
          git push --force "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "refs/tags/$MAJOR"