release.yml

name: Release

# Dispatched by the release-detect job in main.yml when CHANGELOG.md describes a version that is
# not on npm yet. It can also be run by hand, which is the way to retry a release that failed
# halfway: publishing and creating the GitHub release are both skipped when they already happened.
on:
  workflow_dispatch:
    inputs:
      version:
        description: "Version to release. Must be the latest release in CHANGELOG.md."
        required: true
        type: string

permissions:
  contents: read

jobs:
  release:
    runs-on: ubuntu-latest
    # The npm trusted publisher is configured for this environment, so a publish can only come from
    # a job that runs in it.
    environment: release
    permissions:
      contents: write # create the tag and the GitHub release
      id-token: write # OIDC token for npm trusted publishing

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0

      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org
          package-manager-cache: false

      # Trusted publishing needs npm 11.5.1 or later, which is newer than what some runner images
      # ship with.
      - name: Update npm
        run: npm install -g npm@latest

      - name: Setup dotnet
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          global-json-file: global.json

      # --ignore-scripts skips the root postinstall build, because the package's own prepack builds
      # the daemon and the plugin when `bun pm pack` runs.
      - name: Install node_modules
        run: bun install --frozen-lockfile --ignore-scripts

      - name: Publish
        env:
          GH_TOKEN: ${{ github.token }}
        run: bun run release:publish ${{ inputs.version }}