release.yml

name: Release

on:
  release:
    types: [published]

permissions:
  contents: read
  packages: write

jobs:
  version:
    runs-on: ubuntu-latest
    outputs:
      result: ${{ steps.version.outputs.result }}
    steps:
      - id: version
        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
        with:
          script: |
            const semver = context.ref.replace('refs/tags/v', '')
            if (semver.match(/^[0-9]+\.[0-9]+\.[0-9]+$/)) {
                return semver
            }
            throw new Error('not semver, ref: ${context.ref}')
          result-encoding: string

  npm:
    name: Release NPM
    runs-on: ubuntu-latest
    needs: Version
    environment: NPM Release
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0

      - run: corepack enable pnpm

      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
        with:
          node-version-file: '.nvmrc'
          cache: pnpm

      - run: pnpm install --frozen-lockfile

      - run: pnpm -r exec npm version ${{ needs.version.outputs.result }} --git-tag-version=false

      - run: pnpm build

      - run: npm config set "//registry.npmjs.org/:_authToken" "\${NPM_AUTH_TOKEN}" --location=project

      - run: pnpm -r publish --access public --tag latest --no-git-checks
        env:
          NPM_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
          NPM_CONFIG_PROVENANCE: true

      - run: npm config delete "//registry.npmjs.org/:_authToken" --location=project
        if: always()