release.yml

# Versions and publishes the packages with Changesets.
#
# With changesets on main, `version` opens or updates the "Version Packages"
# pull request. Merging it leaves no changesets, so the next run packs and
# publishes whatever version npm does not have yet.
#
# Publishing uses npm trusted publishing: npm accepts an OIDC token from this
# workflow file in this repository, so there is no npm token to store or leak.
# The file name is part of that trust configuration on npmjs.com; renaming the
# file breaks publishing until the setting is changed too.
#
# Only the publish job may mint an OIDC token for npm. It installs nothing
# from the lockfile's scripts and builds nothing: the pack job builds without
# any credential and hands over tarballs. The publish job runs in the `npm`
# environment, which the trusted publisher on npmjs.com requires.
#
# Run by hand on main, it skips npm and only publishes the version in
# package.json to the EmDash plugin registry, to retry a failed registry
# release. It has to run from this file: the registry's workflow connection
# names release.yml, and a run of emdash-release.yml would replace it.
name: release

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}

jobs:
  select-mode:
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      mode: ${{ steps.select-mode.outputs.mode }}
      publish-plan-artifact-id: ${{ steps.select-mode.outputs.publish-plan-artifact-id }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .nvmrc
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - id: select-mode
        uses: changesets/action/select-mode@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2

  version:
    needs: select-mode
    if: needs.select-mode.outputs.mode == 'version'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .nvmrc
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - uses: changesets/action/version@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2
        with:
          commit-message: "chore: version packages"
          pr-title: "chore: version packages"

  pack:
    needs: select-mode
    if: needs.select-mode.outputs.mode == 'publish'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      pack-dir-artifact-id: ${{ steps.pack.outputs.pack-dir-artifact-id }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .nvmrc
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm build
      - id: pack
        uses: changesets/action/pack@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2
        with:
          publish-plan-artifact-id: ${{ needs.select-mode.outputs.publish-plan-artifact-id }}

  publish:
    needs: pack
    runs-on: ubuntu-latest
    environment: npm
    permissions:
      contents: write
      id-token: write
    outputs:
      published: ${{ steps.changesets.outputs.published }}
      published-packages: ${{ steps.changesets.outputs['published-packages'] }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .nvmrc
          package-manager-cache: false
      # Trusted publishing needs pnpm 11.1.3 or later (the OIDC fix for an
      # .npmrc written by setup-node) and, for npm itself, 11.5.1 or later.
      - run: pnpm --version && npm --version
      - run: pnpm install --frozen-lockfile --ignore-scripts
      - id: changesets
        uses: changesets/action/publish@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2
        with:
          pack-dir-artifact-id: ${{ needs.pack.outputs.pack-dir-artifact-id }}

  # Publishes the same versions to the EmDash plugin registry. Only packages
  # with an emdash-plugin.jsonc go there; the plan step skips the rest.
  publish-emdash-plugins:
    needs: publish
    if: needs.publish.outputs.published == 'true'
    uses: ./.github/workflows/emdash-release.yml
    with:
      published-packages: ${{ needs.publish.outputs['published-packages'] }}
    permissions:
      contents: read
      id-token: write
      attestations: write

  registry-retry-version:
    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      published-packages: ${{ steps.read.outputs.published-packages }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - id: read
        run: echo "published-packages=$(jq -c '[{name, version}]' package.json)" >> "${GITHUB_OUTPUT}"

  registry-retry:
    needs: registry-retry-version
    uses: ./.github/workflows/emdash-release.yml
    with:
      published-packages: ${{ needs.registry-retry-version.outputs.published-packages }}
    permissions:
      contents: read
      id-token: write
      attestations: write