release.yml

name: Publish release

# Manually triggered release. Tests are not run here: they run in CI on every
# push to main. Bumps every workspace package to the same version, pushes the
# bump commit, publishes to npm via OIDC trusted publishing (no NPM_TOKEN) and
# creates the GitHub release.
#
# Publishing is only possible from the `main` environment, which is
# restricted to the `main` branch; the npm trusted publisher configuration
# for each package must reference this workflow and that environment.
on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version number or patch, minor, major'
        required: true
        type: string
      prerelease:
        description: 'Release as pre-release'
        required: false
        type: boolean
        default: false

jobs:
  release-npm:
    if: ${{ github.ref == 'refs/heads/main' }}
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    environment: main
    permissions:
      id-token: write
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup pnpm
        uses: pnpm/action-setup@v6

      - name: Setup Node
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: pnpm
          registry-url: 'https://registry.npmjs.org'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Typecheck
        run: pnpm typecheck:all

      - name: Lint (ESLint + neostandard, type-stripping guard)
        run: pnpm lint

      - name: Bump version
        id: bump
        env:
          VERSION_INPUT: ${{ inputs.version }}
        run: |
          node scripts/bump-version.mjs "$VERSION_INPUT" "$GITHUB_ACTOR"
          version=$(node -p "require('./package.json').version")
          printf 'version=%s\n' "$version" >> "$GITHUB_OUTPUT"

      - name: Push changes
        run: git push origin HEAD:${{ github.ref }}

      - name: Publish packages to npm (OIDC + provenance)
        run: pnpm -r publish --access public --tag ${{ inputs.prerelease == true && 'next' || 'latest' }} --provenance --publish-branch ${{ github.ref_name }} --no-git-checks

      - name: Create draft release notes
        env:
          GITHUB_TOKEN: ${{ github.token }}
          RELEASE_VERSION: ${{ steps.bump.outputs.version }}
        run: |
          pnpx @matteo.collina/release-notes -t "v$RELEASE_VERSION" -r sqlite-js-stream -o platformatic -d ${{ inputs.prerelease == true && '-p' || '' }} -c "$(git rev-parse HEAD)"

      - name: Publish GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
          PRERELEASE: ${{ inputs.prerelease }}
          RELEASE_VERSION: ${{ steps.bump.outputs.version }}
        run: |
          if [ "$PRERELEASE" = 'true' ]; then
            gh release edit "v$RELEASE_VERSION" --draft=false
          else
            gh release edit "v$RELEASE_VERSION" --draft=false --latest
          fi