release.yml

name: Release

on:
  push:
    branches:
      - master

concurrency: ${{ github.workflow }}-${{ github.ref }}

permissions:
  contents: write
  pull-requests: write
  # OIDC
  id-token: write

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    env:
      # Force npm to emit provenance (SLSA) when publishing via OIDC.
      NPM_CONFIG_PROVENANCE: true

    steps:
      - name: Checkout Repo
        uses: actions/checkout@v4

      - name: Setup Node.js 24.x
        uses: actions/setup-node@v4
        with:
          node-version: 24.x

      - name: Ensure npm 11.5.1+ for trusted publishing
        run: npm install -g npm@^11.8.0

      - name: Enable Corepack
        run: corepack enable

      - name: Install Dependencies
        run: yarn

      - name: Create Release Pull Request or Publish to npm
        id: changesets
        uses: changesets/action@e0145edc7d9d8679003495b11f87bd8ef63c0cba
        with:
          # This expects you to have a script called release which does a build for your packages and calls changeset publish
          version: yarn changeset version
          publish: yarn release
          commitMode: github-api
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_CONFIG_PROVENANCE: true