release.yml

name: Release
on:
  push:
    tags: ['v*.*.*']
permissions:
  contents: read
jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org
          package-manager-cache: false
      - run: npm install --global npm@11.15.0
      - name: Verify immutable tag matches package version
        shell: bash
        run: test "${GITHUB_REF_NAME#v}" = "$(node -p "require('./package.json').version")"
      - run: npm ci --ignore-scripts
      - run: npm run build
      - run: npm test
      - run: npm run coverage
      - run: npm run lint
      - run: npm audit --audit-level=high
      - run: npm run package:smoke
      - run: npm run action:check
      - run: git diff --exit-code -- dist package.json package-lock.json
      - run: npm publish --provenance --access public
      - name: Create new GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          node --input-type=module <<'NODE'
          import fs from 'node:fs';
          const version = JSON.parse(fs.readFileSync('package.json', 'utf8')).version;
          const section = fs.readFileSync('CHANGELOG.md', 'utf8').split(/^## /m).find(part => part.startsWith(`${version}\n`));
          if (!section) throw new Error('Missing release notes for the package version');
          fs.writeFileSync('release-notes.md', `## ${section.trim()}\n`);
          NODE
          gh release create "$GITHUB_REF_NAME" --verify-tag --title "$GITHUB_REF_NAME" --notes-file release-notes.md --generate-notes