release.yml

name: Release

on:
  push:
    branches:
      - master
  workflow_dispatch:

permissions:
  contents: read

jobs:
  release:
    runs-on: ubuntu-latest
    name: Release Packages
    # Only run on push to master branch (never on workflow_dispatch, etc.)
    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
    permissions:
      contents: write  # Needed for creating tags and GitHub releases
      id-token: write  # Needed for OIDC token generation (npm trusted publishing)
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          # Use default GITHUB_TOKEN for authentication (no SSH key needed)

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          registry-url: 'https://registry.npmjs.org'

      - name: Update npm to latest version
        run: npm install -g npm@11.6.2

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libsecret-1-dev

      - name: Install dependencies
        run: npm ci

      - name: Build packages
        run: npx nx run-many -t build --parallel=3

      - name: Configure Git
        run: |
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git config user.name "github-actions[bot]"

      - name: 🚀 Run Nx Release
        run: npx nx release -y
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Built-in token (auto-scoped, ephemeral)
          NPM_CONFIG_PROVENANCE: true  # Enable npm provenance attestations via OIDC