release.yml

# Tag -> release flow (org standard).
#
# release-please maintains a release PR that accumulates conventional commits
# and, when merged, creates a vX.Y.Z git tag + GitHub Release and bumps the
# version manifest.
#
# This gives every repo an explicit, immutable version. Consumers pin exact
# versions (see VERSIONING.md); nothing deploys or resolves from a moving
# branch.
name: Release

on:
  push:
    branches: [main]

permissions:
  contents: write
  pull-requests: write

jobs:
  release-please:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    outputs:
      release_created: ${{ steps.rp.outputs.release_created }}
      tag_name: ${{ steps.rp.outputs.tag_name }}
    steps:
      # Author the release PR with the personal-stack-agents App token (not the
      # default GITHUB_TOKEN) so CI runs on the PR without a manual approval
      # gate. Best-effort: falls back to GITHUB_TOKEN when the App secrets or
      # installation are absent.
      - uses: actions/create-github-app-token@v3
        id: app-token
        continue-on-error: true
        with:
          app-id: ${{ secrets.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
      - uses: googleapis/release-please-action@v5
        id: rp
        with:
          token: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json

  publish:
    needs: release-please
    if: ${{ needs.release-please.outputs.release_created == 'true' }}
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      packages: write
    steps:
      # The reusable workflows and actions here are consumed by version
      # tag/ref. tools/deploy-check is additionally published so developers can
      # run the same checks locally without vendoring a copy into every service
      # repository. CI never consumes the published package -- it runs the tool
      # from the checked-out workflow SHA -- so a publish failure cannot break
      # the deployment gate.
      - name: Publish tag-ref deliverable
        run: echo "Released ${{ needs.release-please.outputs.tag_name }}"

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          registry-url: https://npm.pkg.github.com
          scope: '@jorisjonkers-dev'

      - name: Align the package version with the release tag
        working-directory: tools/deploy-check
        env:
          TAG_NAME: ${{ needs.release-please.outputs.tag_name }}
        run: npm version "${TAG_NAME#v}" --no-git-tag-version --allow-same-version

      - name: Publish @jorisjonkers-dev/deploy-check
        working-directory: tools/deploy-check
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: npm publish