release.yml

name: Release

on:
  push:
    branches: [main]

concurrency: ${{ github.workflow }}-${{ github.ref }}

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write       # changesets commits the version PR + tags
      pull-requests: write  # changesets opens the "Version Packages" PR
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: pnpm
          registry-url: 'https://registry.npmjs.org'
      - run: pnpm install --frozen-lockfile
      - run: pnpm typecheck
      - run: pnpm test:run
      # Publishes with NPM_TOKEN. To switch to token-free OIDC later: add
      # `id-token: write` above, `- run: npm i -g npm@latest`, drop the NPM_TOKEN
      # env, and register this repo + release.yml as each package's trusted publisher.
      - name: Create release PR or publish
        uses: changesets/action@v1
        with:
          version: pnpm run version-packages
          publish: pnpm run release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}