release.yml

name: Release

# Publishes every @bugsee package to npm through TRUSTED PUBLISHING (OIDC) — there is no npm token in
# this repository. Each package on npm has this workflow file registered as its trusted publisher
# (`node scripts/npm-trust-all.mjs`), so npm accepts the short-lived identity token GitHub mints for
# this run and nothing long-lived exists to leak.
#
# GitHub-hosted runner: npm trusted publishing does not support self-hosted runners
# (docs.npmjs.com/trusted-publishers). Every workflow in this repository uses GitHub-hosted runners.
#
# The file NAME is part of the trust relationship. Renaming it silently breaks publishing until every
# package is re-registered.
on:
  workflow_dispatch:
    inputs:
      tag:
        description: npm dist-tag to publish under
        default: latest
        required: true
      dry_run:
        description: Pack and `npm publish --dry-run` only — publishes nothing
        type: boolean
        default: true

permissions:
  contents: read
  id-token: write # the OIDC token npm exchanges for publish rights

concurrency:
  group: release
  cancel-in-progress: false

jobs:
  publish:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v7

      - name: Install pnpm
        uses: pnpm/action-setup@v6

      - name: Setup Node
        uses: actions/setup-node@v7
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org

      # Trusted publishing needs npm >= 11.5.1; fail loudly rather than fall back to a token prompt.
      - name: Check npm version
        run: |
          npm --version
          node -e 'const [a,b,c]=process.argv[1].split(".").map(Number); if (a<11||(a===11&&(b<5||(b===5&&c<1)))) { console.error("npm >= 11.5.1 required"); process.exit(1) }' "$(npm --version)"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Release gate (metadata + one version)
        run: pnpm check:publishable

      - name: Build
        run: pnpm exec turbo run build

      # Inputs go in through the environment, never interpolated into the script text: a `${{ }}` inside
      # `run:` is textually pasted into the shell, so a crafted tag could execute commands with the
      # job's id-token.
      - name: Publish
        env:
          NPM_TAG: ${{ inputs.tag }}
          DRY_RUN: ${{ inputs.dry_run }}
        run: |
          if [ "$DRY_RUN" = "true" ]; then
            node scripts/publish-all.mjs --tag "$NPM_TAG" --dry-run
          else
            node scripts/publish-all.mjs --tag "$NPM_TAG"
          fi