release.yml

name: Release

# Fires on git tags shaped like v1.0.0, v1.0.1, v1.1.0, etc.
# - Builds + verifies (tests).
# - Publishes to npm with --provenance (uses NPM_TOKEN secret).
# - Creates a GitHub Release with auto-generated notes.

on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'
      - 'v[0-9]+.[0-9]+.[0-9]+-*'   # pre-release tags (e.g. v1.0.0-rc.1)

permissions:
  contents: write     # needed to create the GitHub Release
  id-token: write     # needed for npm --provenance attestation

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0      # fetch tags + history so gh release notes can compute since-last-tag

      - name: Set up Node
        uses: actions/setup-node@v6
        with:
          node-version: "20"
          registry-url: "https://registry.npmjs.org"

      - name: Verify tag matches package.json version
        run: |
          TAG="${GITHUB_REF_NAME#v}"
          PKG_VERSION=$(node -p "require('./package.json').version")
          if [ "$TAG" != "$PKG_VERSION" ]; then
            echo "::error::Tag $GITHUB_REF_NAME does not match package.json version $PKG_VERSION"
            exit 1
          fi
          echo "Tag and package.json version match: $PKG_VERSION"

      - name: Install dependencies
        run: npm ci

      - name: Audit dependencies
        run: npm audit --audit-level=critical

      - name: Build
        run: npm run build

      - name: Test
        run: npm test

      - name: Built-CLI smoke
        run: |
          BUILT_VERSION=$(node dist/cli.js --version)
          PKG_VERSION=$(node -p "require('./package.json').version")
          if [ "$BUILT_VERSION" != "$PKG_VERSION" ]; then
            echo "::error::Built CLI version $BUILT_VERSION does not match package.json $PKG_VERSION"
            exit 1
          fi
          echo "CLI version smoke: $BUILT_VERSION"

      - name: Publish to npm (with provenance)
        run: npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create "$GITHUB_REF_NAME" \
            --title "$GITHUB_REF_NAME" \
            --generate-notes \
            --verify-tag