release.yml

name: Release

on:
  push:
    branches: [main]

# Never run two releases against the same ref at once.
concurrency: ${{ github.workflow }}-${{ github.ref }}

permissions:
  contents: write # push the Version Packages branch, git tags, and GitHub releases
  pull-requests: write # open/update the Version Packages PR
  id-token: write # OIDC token for npm trusted publishing (no NPM_TOKEN)

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # ripgrep backs @harpua/agent-tools' file-exploration + web-research tools;
      # the pre-publish `build lint test` gate below runs their specs, which
      # shell out to `rg` (matches ci.yml). Without it the release gate fails.
      - name: Install ripgrep
        run: sudo apt-get update && sudo apt-get install -y ripgrep

      # Enable Corepack so the pnpm version pinned by `packageManager` is used (matches ci.yml).
      - name: Enable Corepack
        run: corepack enable

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      # Trusted publishing (OIDC) needs npm CLI >= 11.5.1; Node 22 ships npm 10.x.
      # `changeset publish` -> `pnpm publish` delegates the actual upload to this npm
      # binary, so the upgraded npm is what performs the OIDC token exchange.
      # PINNED (not @latest): a broken npm@latest shipped a provenance generator that
      # can't resolve its bundled `sigstore` module ("Cannot find module 'sigstore'"),
      # which aborts every publish. 11.5.1 is the OIDC minimum and bundles sigstore.
      - name: Upgrade npm for trusted publishing
        run: npm install -g npm@11.5.1

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # Full root protocol before any publish so a broken Version Packages merge cannot ship.
      - name: Build, lint, and test
        run: pnpm turbo build lint test --force

      - name: Create Release Pull Request or publish
        uses: changesets/action@v1
        with:
          version: pnpm exec changeset version
          publish: pnpm exec changeset publish
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}