This repository was archived by the owner on Jun 16, 2026. It is now read-only.
feat(ci): add release.yml — tag-push triggers npm publish + GH release #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Fires on git tags shaped like v1.0.0, v1.0.1, v1.1.0, etc. | |
| # - Builds + verifies (tests). | |
| # - Publishes to npm with --provenance (uses NPM_TOKEN secret). | |
| # - Creates a GitHub Release with auto-generated notes. | |
| on: | |
| push: | |
| tags: | |
| - 'v[0-9]+.[0-9]+.[0-9]+' | |
| - 'v[0-9]+.[0-9]+.[0-9]+-*' # pre-release tags (e.g. v1.0.0-rc.1) | |
| permissions: | |
| contents: write # needed to create the GitHub Release | |
| id-token: write # needed for npm --provenance attestation | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 # fetch tags + history so gh release notes can compute since-last-tag | |
| - name: Set up Node | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "20" | |
| registry-url: "https://registry.npmjs.org" | |
| - name: Verify tag matches package.json version | |
| run: | | |
| TAG="${GITHUB_REF_NAME#v}" | |
| PKG_VERSION=$(node -p "require('./package.json').version") | |
| if [ "$TAG" != "$PKG_VERSION" ]; then | |
| echo "::error::Tag $GITHUB_REF_NAME does not match package.json version $PKG_VERSION" | |
| exit 1 | |
| fi | |
| echo "Tag and package.json version match: $PKG_VERSION" | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Audit dependencies | |
| run: npm audit --audit-level=critical | |
| - name: Build | |
| run: npm run build | |
| - name: Test | |
| run: npm test | |
| - name: Built-CLI smoke | |
| run: | | |
| BUILT_VERSION=$(node dist/cli.js --version) | |
| PKG_VERSION=$(node -p "require('./package.json').version") | |
| if [ "$BUILT_VERSION" != "$PKG_VERSION" ]; then | |
| echo "::error::Built CLI version $BUILT_VERSION does not match package.json $PKG_VERSION" | |
| exit 1 | |
| fi | |
| echo "CLI version smoke: $BUILT_VERSION" | |
| - name: Publish to npm (with provenance) | |
| run: npm publish --provenance --access public | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| - name: Create GitHub Release | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh release create "$GITHUB_REF_NAME" \ | |
| --title "$GITHUB_REF_NAME" \ | |
| --generate-notes \ | |
| --verify-tag |