release.yml

name: Release

on:
    push:
        branches:
            - main

concurrency: ${{ github.workflow }}-${{ github.ref }}

jobs:
    release:
        name: Release (${{ github.ref }})
        runs-on: ubuntu-latest
        permissions:
            contents: write
            issues: write
            pull-requests: write
            # Lets npm mint a short-lived OIDC token instead of using a long-lived
            # NPM_TOKEN. Requires a Trusted Publisher pointing at this workflow file.
            id-token: write
        steps:
            - name: Checkout Repository
              uses: actions/checkout@v7

            - name: Setup PNPM
              uses: pnpm/action-setup@v6
              with:
                  run_install: true

            - name: Build
              run: pnpm build

            - name: Create Release Pull Request or Publish to NPM
              id: changesets
              uses: changesets/action@v1
              with:
                  publish: pnpm changeset publish
                  version: pnpm changeset version
                  title: Release Packages
                  commit: bump versions
              env:
                  # No NPM_TOKEN on purpose: changesets/action writes an .npmrc when it
                  # sees one, and that credential would take precedence over OIDC.
                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}