release.yml

name: release
run-name: "release '${{ github.event.inputs.version }}' version by @${{ github.actor }}"

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version'
        required: true
        default: 'patch'
        type: choice
        options:
          - 'major'
          - 'minor'
          - 'patch'

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write # Enable OIDC
      pull-requests: write
      contents: write

    steps:
      - uses: actions/checkout@v4

      - uses: chainguard-dev/actions/setup-gitsign@main

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          registry-url: 'https://registry.npmjs.org'

      - name: Cache node_modules
        id: cache-node_modules
        uses: actions/cache@v4
        with:
          path: node_modules
          key: ${{ runner.os }}-node_modules-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node_modules-
            ${{ runner.os }}-

      - name: Install dependencies
        if: steps.cache-node_modules.outputs.cache-hit != 'true'
        run: |
          npm ci

      - name: Setup git
        run: |
          git config --global tag.gpgsign true

      - name: Bump version
        run: |
          npm version ${{ github.event.inputs.version }} --sign-git-tag

      - name: Push changes
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          VERSION=$(node -p "require('./package.json').version")
          git push --follow-tags
          gh release create "v${VERSION}" --generate-notes

      - name: Publish to npm
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          npm publish --access public