release.yml

name: Release

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      version:
        description: 'Exact version to release (e.g. 1.2.3). Leave empty to auto-bump.'
        required: false
        type: string
      preid:
        description: 'Pre-release identifier (e.g. beta, rc). Optional'
        required: false
        type: string
      npm_tag:
        description: 'npm dist-tag (e.g. latest, beta)'
        required: false
        default: 'latest'
        type: string

permissions:
  contents: write
  id-token: write

jobs:
  ci:
    name: CI
    uses: ./.github/workflows/ci.yml
    with:
      full: true

  release:
    name: Release & Publish
    runs-on: ubuntu-latest
    needs: ci
    permissions:
      contents: write
      id-token: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Use Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: 'npm'
          registry-url: 'https://registry.npmjs.org'

      - name: Update npm
        run: |
          npm install -g npm@11.7.0
          npm -v

      - name: Diagnostic info
        run: |
          echo "node=$(node -v)"
          echo "npm=$(npm -v)"
          if [ -n "${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" ]; then
            echo "oidc=available"
          else
            echo "oidc=missing"
          fi

      - name: Inspect OIDC claims
        run: |
          if [ -z "${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" ] || [ -z "${ACTIONS_ID_TOKEN_REQUEST_URL}" ]; then
            echo "OIDC token request env vars are missing"
            exit 1
          fi

          RESPONSE="$(curl -sSf -H "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=npm:registry.npmjs.org")"
          OIDC_TOKEN="$(node -e 'const fs = require("fs"); const input = fs.readFileSync(0, "utf8"); process.stdout.write(JSON.parse(input).value);' <<< "$RESPONSE")"

          node - <<'EOF' "$OIDC_TOKEN"
          const token = process.argv[2];
          const payload = token.split(".")[1];

          if (!payload) {
            throw new Error("Unable to decode OIDC token payload");
          }

          const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
          const out = {
            aud: claims.aud,
            repository: claims.repository,
            repository_owner: claims.repository_owner,
            ref: claims.ref,
            sha: claims.sha,
            event_name: claims.event_name,
            workflow: claims.workflow,
            workflow_ref: claims.workflow_ref,
            job_workflow_ref: claims.job_workflow_ref,
            runner_environment: claims.runner_environment,
            environment: claims.environment,
            actor: claims.actor,
            sub: claims.sub,
          };

          console.log(JSON.stringify(out, null, 2));
          EOF

      - name: Install dependencies
        run: npm ci

      - name: Configure Git user
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Run release-it
        env:
          DEBUG: release-it:*,@release-it/*
          HUSKY: 0
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION_ARG=""
          if [ -n "${{ inputs.version }}" ]; then
            VERSION_ARG="${{ inputs.version }}"
          fi

          PREID_ARG=""
          if [ -n "${{ inputs.preid }}" ]; then
            PREID_ARG="--preRelease=${{ inputs.preid }}"
          fi

          if [ -n "${{ inputs.npm_tag }}" ]; then
            NPM_TAG="${{ inputs.npm_tag }}"
          else
            NPM_TAG="latest"
          fi
          NPM_TAG_ARG="--npm.tag=${NPM_TAG}"

          npx release-it --ci $PREID_ARG $NPM_TAG_ARG $VERSION_ARG

      - name: Sync main → develop
        uses: devmasx/merge-branch@v1.4.0
        with:
          type: now
          from_branch: main
          target_branch: develop
          github_token: ${{ secrets.GITHUB_TOKEN }}
        env:
          HUSKY: 0