release.yml

name: CLI release

on:
  release:
    types: [published]

permissions:
  contents: read
  id-token: write

concurrency:
  group: cli-release-${{ github.event.release.tag_name }}
  cancel-in-progress: false

jobs:
  release:
    name: Validate and publish
    runs-on: ubuntu-latest
    if: startsWith(github.event.release.tag_name, 'v') && github.event.release.prerelease == false
    steps:
      - name: Checkout release tag
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.release.tag_name }}
          fetch-depth: 0

      - name: Install pnpm
        uses: pnpm/action-setup@v5

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
          registry-url: https://registry.npmjs.org
          package-manager-cache: false

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Verify release tag
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          PACKAGE_VERSION=$(node -p "require('./package.json').version")
          test "${RELEASE_TAG}" = "v${PACKAGE_VERSION}"

      - name: Validate release contents
        run: pnpm run release:check

      - name: Publish package
        run: npm publish --provenance --access public