release.yml

name: Release

on:
  push:
    tags:
      - 'v*.*.*'
  workflow_dispatch:

permissions:
  contents: write
  id-token: write
  attestations: write

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Use Node.js 20
        uses: actions/setup-node@v6
        with:
          node-version: 20

      - name: Install dependencies
        run: npm ci

      - name: Lint
        run: npm run lint

      - name: Test
        run: npm run test

      - name: Build
        run: npm run build

      - name: Bundle
        run: npm run bundle

      - name: Ensure bundled dist is committed
        run: |
          if ! git diff --quiet -- dist; then
            echo '::error::Bundling modified files under dist/. Run npm run bundle locally and commit the results before tagging.'
            git status --short dist
            exit 1
          fi

      - name: Generate build provenance attestation
        if: startsWith(github.ref, 'refs/tags/')
        uses: actions/attest-build-provenance@v3
        with:
          subject-path: dist/**

      - name: Update major tag
        if: startsWith(github.ref, 'refs/tags/')
        env:
          TAG_NAME: ${{ github.ref_name }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

          MAJOR_TAG="${TAG_NAME%%.*}"
          if [[ -z "${MAJOR_TAG}" || "${MAJOR_TAG}" == "${TAG_NAME}" ]]; then
            echo "::warning::Unable to determine major tag from ${TAG_NAME}; skipping floating tag update."
            exit 0
          fi

          git tag -f "${MAJOR_TAG}" "$TAG_NAME"
          git push origin "${MAJOR_TAG}" --force

      - name: Publish GitHub release
        if: startsWith(github.ref, 'refs/tags/')
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG_NAME: ${{ github.ref_name }}
        run: |
          if gh release view "$TAG_NAME" >/dev/null 2>&1; then
            echo "Release $TAG_NAME already exists; skipping creation."
          else
            gh release create "$TAG_NAME" --title "$TAG_NAME" --notes "See CHANGELOG.md for details." --latest
          fi