release.yml

name: Release

# Publishes @captchaapi/react to npm when a GitHub Release is published.
# Bump the version in package.json, update CHANGELOG.md, then cut a Release.
#
# One-time setup: add an automation npm token as the repo secret NPM_TOKEN
# (npmjs.com -> Access Tokens -> Generate -> "Automation"). It needs publish
# rights on the @captchaapi scope.

on:
  release:
    types: [published]

permissions:
  contents: read
  id-token: write

concurrency:
  group: release-npm
  cancel-in-progress: false

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          registry-url: 'https://registry.npmjs.org'

      - run: npm ci

      # prepublishOnly runs lint, typecheck, coverage, and build before publish
      - run: npm publish --provenance
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}