release.yml

# Auto patch-bump + npm publish on every push to main (creator-controlled via secrets).
# Skip with [skip release] in the commit message, or when the commit is chore(release):…
#
# Required secret: NPM_TOKEN (npm Automation token with publish rights)
name: Release

on:
  push:
    branches: [main]

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest
    # Anti-loop + explicit skip
    if: >
      github.event_name == 'push' &&
      !contains(github.event.head_commit.message, '[skip release]') &&
      !contains(github.event.head_commit.message, '[skip-release]') &&
      !contains(github.event.head_commit.message, '[no release]') &&
      !startsWith(github.event.head_commit.message, 'chore(release)')
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "22"
          registry-url: "https://registry.npmjs.org"
          cache: npm

      - name: Install
        run: npm ci

      - name: Typecheck
        run: npm run typecheck

      - name: Unit tests
        run: npm test

      - name: Build CLI
        run: npm run build:cli

      - name: Bump patch version
        id: bump
        run: |
          npx tsx scripts/bump-version.ts patch "Automated release from main."
          VERSION=$(node -p "require('./package.json').version")
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Bumped to $VERSION"

      - name: Commit release metadata
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add package.json package-lock.json CHANGELOG.md
          git commit -m "chore(release): v${{ steps.bump.outputs.version }}"
          git tag "v${{ steps.bump.outputs.version }}"
          git push origin HEAD:main --tags

      - name: Publish to npm
        run: |
          if [ -z "$NODE_AUTH_TOKEN" ]; then
            echo "NPM_TOKEN secret is not set — skipped npm publish."
            echo "Tag v${{ steps.bump.outputs.version }} was still pushed."
            exit 0
          fi
          npm publish --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ steps.bump.outputs.version }}
          name: v${{ steps.bump.outputs.version }}
          generate_release_notes: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}