release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

jobs:
  build:
    runs-on: open-source-releaser
    permissions:
      contents: read
    env:
      TAG_NAME: ${{ github.ref_name }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
          ref: ${{ github.sha }}

      - name: Validate tag
        run: |
          if ! [[ "$TAG_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Invalid tag: $TAG_NAME (expected vMAJOR.MINOR.PATCH)"
            exit 1
          fi

          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
            echo "Tag commit is not on main"
            exit 1
          fi

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          cache: npm

      - run: npm ci
      - run: npm test
      - run: npm run build

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-dist
          path: dist/
          if-no-files-found: error

  release:
    needs: build
    runs-on: open-source-releaser
    permissions:
      contents: write
    env:
      TAG_NAME: ${{ github.ref_name }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
          ref: ${{ github.sha }}

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: release-dist
          path: dist/

      - name: Bundle dist and create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          remote_tag_ref="refs/remotes/origin/release/$TAG_NAME"
          git fetch --no-tags origin \
            "+refs/tags/$TAG_NAME:$remote_tag_ref"
          remote_tag_oid=$(git rev-parse "$remote_tag_ref")
          remote_commit_oid=$(git rev-parse "$remote_tag_ref^{commit}")
          if [[ "$remote_commit_oid" != "$GITHUB_SHA" ]]; then
            echo "Tag $TAG_NAME points to $remote_commit_oid, expected $GITHUB_SHA"
            exit 1
          fi

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          gh auth setup-git
          git add -f dist/
          if git diff --staged --quiet; then
            echo "dist/ already bundled in $TAG_NAME"
          else
            git commit -m "Build dist for $TAG_NAME"
            git tag -f "$TAG_NAME"
            git push origin "refs/tags/$TAG_NAME" \
              --force-with-lease="refs/tags/$TAG_NAME:$remote_tag_oid"
          fi

          # Dist retags leave previous tags off the main ancestry, so
          # auto-detection fails — pin notes to the previous semver tag.
          previous_tag=$(
            git tag -l 'v*' --sort=-v:refname |
              grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' |
              grep -vx "$TAG_NAME" |
              head -n 1 || true
          )

          args=(--title "$TAG_NAME" --generate-notes)
          [[ -n "$previous_tag" ]] && args+=(--notes-start-tag "$previous_tag")

          if gh release view "$TAG_NAME" >/dev/null 2>&1; then
            echo "Release $TAG_NAME already exists"
          else
            gh release create "$TAG_NAME" "${args[@]}"
          fi