name: release

# Releases are automated by release-it. The version bump, CHANGELOG.md,
# commit, tag, GitHub release, and npm publish (via OIDC trusted publishing)
# are all driven by `npm run release:ci`. Trigger manually from the
# Actions tab once the next batch of feature/fix PRs is on main.
on:
  workflow_dispatch:

concurrency:
  group: release
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest
    environment: production
    permissions:
      contents: write
      issues: write
      pull-requests: write
      id-token: write
    steps:
      - uses: actions/checkout@v7
        with:
          # release-it needs the full history + tags to compute the bump
          # and write the CHANGELOG.
          fetch-depth: 0
      - uses: actions/setup-node@v6
        with:
          node-version: lts/*
          package-manager-cache: false
      - run: npm ci || npm install
      # release-it commits the version bump + CHANGELOG update and pushes
      # the tag. GitHub Actions runners ship without a configured git
      # identity, so configure one from the actor that dispatched the
      # workflow (per release-it CI docs).
      - name: Configure git identity
        run: |
          git config --global user.name "${GITHUB_ACTOR}"
          git config --global user.email "${GITHUB_ACTOR}@users.noreply.github.com"
      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: npm run release:ci