release.yml

name: Release

on:
  push:
    branches: [production]

concurrency: ${{ github.workflow }}-${{ github.ref }}

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          # The dev sync step compares dev with production.
          fetch-depth: 0

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
          registry-url: https://registry.npmjs.org

      - run: pnpm install --frozen-lockfile

      - name: Build
        run: pnpm -r build

      - name: Typecheck
        run: pnpm -r typecheck

      - name: Test
        run: pnpm test

      # Trusted publishing (OIDC) needs npm 11.5.1 or newer. Stay on npm 11:
      # npm 12 rejects unknown CLI flags, and pnpm passes --git-checks through
      # to npm publish, so every publish fails with EUNKNOWNCONFIG on npm 12.
      - name: Ensure npm supports OIDC
        run: npm install -g npm@11

      - name: Create Release PR or Publish
        id: changesets
        uses: changesets/action@v1
        with:
          publish: pnpm changeset publish
          title: 'chore: version packages'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      # After a publish, dev has to catch up with production (the version commit).
      # dev requires CI, and a PR opened with GITHUB_TOKEN doesn't trigger CI, so the
      # sync PR is opened with a token from the release bot GitHub App when it's set
      # up (CONTRIBUTING.md, "Releasing to production"). Without it, the job summary
      # says what to run.
      - name: Get a release bot token
        id: bot-token
        if: steps.changesets.outputs.published == 'true' && vars.RELEASE_BOT_APP_ID != ''
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ vars.RELEASE_BOT_APP_ID }}
          private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}

      - name: Sync dev with production
        if: steps.changesets.outputs.published == 'true'
        env:
          GH_TOKEN: ${{ steps.bot-token.outputs.token }}
        run: bash .github/scripts/sync-dev.sh

      # Website is auto-deployed to Cloudflare Workers by Workers Builds