release.yml

name: NPM Publish

on:
  release:
    types: [created]

permissions:
  id-token: write # Required for OIDC provenance attestations
  contents: write # Required for pushing version bump commit

jobs:
  publish-npm:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 24
          cache: pnpm
          registry-url: https://registry.npmjs.org
      - run: pnpm install --frozen-lockfile
      - run: pnpm test
      - run: pnpm run build
      - name: Bump version from release tag
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        run: |
          VERSION=${GITHUB_REF_NAME#v}
          pnpm version $VERSION --no-git-tag-version
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add package.json pnpm-lock.yaml
          git commit -m "chore: bump version to $VERSION"
          git push origin HEAD:$DEFAULT_BRANCH
      - run: pnpm publish --no-git-checks
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}