release.yml

name: Release

# Two release modes through this single workflow file:
#
#   1. Regular release (push to main): runs changesets/action, which either
#      opens a "chore: release" PR with version bumps from queued changesets,
#      or publishes the bumped versions to npm if the release PR has been
#      merged.
#
#   2. Snapshot release (workflow_dispatch): publishes a one-off version under
#      the `snapshot` dist-tag, so changes can be previewed without entering
#      changesets pre-release mode.
#
# Both modes go through this single workflow file because npm Trusted
# Publishers (OIDC) bind publish authorization to one specific workflow
# filename per package. Renaming this file will break publishing until each
# package's npm-side trusted-publisher record is updated to match.
#
# Configure a Trusted Publisher for each released package on npmjs.com:
#   https://www.npmjs.com/package/<package>/access -> Trusted Publisher
#   Repository: creatornader/atrib
#   Workflow:   release.yml
#
# `commitMode: github-api` on changesets/action makes the release commit go
# through the GitHub REST API so it's auto-signed by GitHub. No GPG/SSH key
# wrangling, no commit-signature-rule exceptions.
#
# Node 24+ is required: Node 22's bundled npm 10.x can sign provenance
# attestations but cannot use OIDC tokens to authenticate the publish itself,
# leading to a 404 after provenance signing succeeds. Node 24 ships npm 11.12+
# which fixes this.
#
# Provenance attestations (`NPM_CONFIG_PROVENANCE: "true"`) are set on both
# the release + snapshot jobs. Sigstore publishes a transparency-log entry
# per published version; the npmjs.com package page shows a "Provenance"
# section with sigstore.dev verification links.
#
# Security note: this workflow does NOT interpolate any user-controlled
# github.event.* fields into run: commands, per the GitHub Actions
# script-injection guidance.
#
# See https://docs.npmjs.com/trusted-publishers for the npm-side docs.

on:
  push:
    branches:
      - main
  workflow_dispatch:

concurrency: ${{ github.workflow }}-${{ github.ref }}

# Default to read-only at the workflow level; each job grants only the writes
# it needs (`contents: write`, `pull-requests: write`, `id-token: write`).
permissions:
  contents: read

# Opt into Node.js 24 for transitive JS actions (see ci.yml for rationale).
env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  release:
    if: github.event_name == 'push'
    name: Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      id-token: write
    steps:
      # Mint a GitHub App installation token to use in place of the default
      # GITHUB_TOKEN. Required because GitHub's anti-loop policy blocks
      # workflows triggered by GITHUB_TOKEN pushes from firing other
      # workflows (push / pull_request events). The changesets-bot's
      # Version Packages PR is opened with GITHUB_TOKEN by default, which
      # means the required test + security-scan checks never run on it
      # until someone closes + reopens the PR to retrigger them. App
      # installation tokens are a non-GITHUB_TOKEN identity, so their
      # pushes DO trigger downstream workflows.
      #
      # App: atrib-release-bot (https://github.com/settings/apps)
      # Permissions: contents:write, pull-requests:write
      # Installed on: creatornader/atrib only
      # Secrets:
      #   RELEASE_APP_ID         - the App's Client ID (the "Iv23li..."
      #                            string shown on the App settings page).
      #                            The secret name is historical; this workflow
      #                            passes it as `client-id`.
      #   RELEASE_APP_PRIVATE_KEY - the PEM contents (multiline)
      - name: Mint GitHub App installation token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ secrets.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

      - name: Checkout
        uses: actions/checkout@v7
        with:
          token: ${{ steps.app-token.outputs.token }}

      - name: Setup pnpm
        uses: pnpm/action-setup@v6

      - name: Setup Node
        uses: actions/setup-node@v7
        with:
          node-version: "24"
          cache: "pnpm"
          registry-url: "https://registry.npmjs.org"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Create release PR or publish to npm
        id: changesets
        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
        with:
          publish: pnpm release
          version: pnpm version-packages
          commitMode: github-api
          # Per D060: per-package GitHub Release per version bump alongside the
          # npm publish. Tags + release notes auto-derived from each package's
          # CHANGELOG.md entry by changesets/action.
          createGithubReleases: true
        env:
          NPM_CONFIG_PROVENANCE: "true"
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

  snapshot:
    if: github.event_name == 'workflow_dispatch'
    name: Release snapshot
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          token: ${{ github.token }}

      - name: Setup pnpm
        uses: pnpm/action-setup@v6

      - name: Setup Node
        uses: actions/setup-node@v7
        with:
          node-version: "24"
          cache: "pnpm"
          registry-url: "https://registry.npmjs.org"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build
        run: pnpm -r build

      - name: Snapshot version
        run: pnpm changeset version --snapshot snapshot

      - name: Publish snapshot
        run: pnpm changeset publish --tag snapshot --no-git-tag
        env:
          NPM_CONFIG_PROVENANCE: "true"