release-publish.yml

name: Release and Publish

on:
  workflow_dispatch:
    inputs:
      version_type:
        description: 'Version type (prerelease, prepatch, patch, preminor, minor, premajor, major)'
        required: true
        default: 'patch'
        type: choice
        options:
          - prerelease
          - prepatch
          - patch
          - preminor
          - minor
          - premajor
          - major
      custom_version:
        description: 'Custom version (leave empty to use version_type)'
        required: false
        type: string
      dist_tag:
        description: 'npm distribution tag (latest, next, beta, etc)'
        required: false
        default: 'latest'
        type: string

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release-and-publish:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
      id-token: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          token: ${{ secrets.PAT_GITHUB }}

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: '24.x'
          registry-url: 'https://registry.npmjs.org'

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: '1.4.2'

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Configure Git
        run: |
          git config --local user.email "action@github.com"
          git config --local user.name "GitHub Action"
          git config pull.rebase false

      - name: Bump version
        id: bump_version
        env:
          CUSTOM_VERSION: ${{ inputs.custom_version }}
          VERSION_TYPE: ${{ inputs.version_type }}
        run: |
          npm version "${CUSTOM_VERSION:-$VERSION_TYPE}" --no-git-tag-version
          VERSION=$(node -p "JSON.parse(require('fs').readFileSync('package.json', 'utf8')).version")
          echo "VERSION=$VERSION" >> "$GITHUB_ENV"
          bun install --lockfile-only

      - name: Generate Changelog
        run: |
          npm run changelog
          npm run changelog:latest

      - name: Check types, build and test before release
        run: bun run check

      - name: Commit and tag the verified release
        run: |
          git add package.json bun.lock CHANGELOG.md
          git commit -m "chore: release v$VERSION"
          git tag -a "v$VERSION" -m "Release v$VERSION"
          git push --atomic origin "HEAD:refs/heads/$GITHUB_REF_NAME" "refs/tags/v$VERSION"

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: v${{ env.VERSION }}
          name: Release v${{ env.VERSION }}
          body_path: RELEASE_NOTES.md
          generate_release_notes: false
        env:
          GITHUB_TOKEN: ${{ secrets.PAT_GITHUB }}

      - name: Publish to npm
        run: npm publish --ignore-scripts --access public --provenance --tag "$DIST_TAG"
        env:
          DIST_TAG: ${{ inputs.dist_tag || 'latest' }}
          # Restored the token here to ensure it works
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}