release.yml

name: 'Release'

on:
  workflow_run:
    workflows: ['CI']
    types: [completed]
    branches: [master]
  workflow_dispatch:

# Two master pushes in quick succession queue two release runs against the same
# HEAD; serialising them keeps semantic-release from racing on the tag push.
concurrency:
  group: 'release'
  cancel-in-progress: false

permissions: {}

jobs:
  semantic-release:
    name: 'Release'
    runs-on: ubuntu-latest
    if:
      github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.event == 'push')
    permissions:
      contents: read
      # required for npm trusted publishing (OIDC)
      id-token: write
    steps:
      - name: 'Checkout'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: 'master'
          # the job token is read-only; git push must use the GH_TOKEN PAT from env
          persist-credentials: false
      - name: 'Setup Vite+'
        uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1.15.0
        with:
          node-version: '24'
          cache: true
          run-install: false

      - name: 'Install dependencies'
        run: vp install --frozen-lockfile

      - name: 'Build'
        run: vp run build

      - name: 'Release'
        env:
          # PAT instead of GITHUB_TOKEN so the published release triggers the Discord workflow
          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
        run: vp exec semantic-release

  gen-contributors:
    name: 'Generate Contributors List'
    runs-on: ubuntu-latest
    needs: ['semantic-release']
    permissions:
      contents: write
    steps:
      - name: Contribute List
        uses: akhilmhdh/contributors-readme-action@83ea0b4f1ac928fbfe88b9e8460a932a528eb79f # v2.3.11
        with:
          image_size: 100
          columns_per_row: 8
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}