release.yml

name: Release

env:
  # Use docker.io for Docker Hub if empty
  REGISTRY: ghcr.io
  # github.repository as <account>/<repo>
  IMAGE_NAME: ${{ github.repository }}

concurrency:
  group: "${{ github.workflow }}"
  cancel-in-progress: true # only last step is important, which runs or doesn't

on:
  workflow_dispatch: # releasing is manual as we don't want to release every time

permissions:
  contents: write # to write tags
  packages: write # to write tags to Docker registry
  issues: write
  pull-requests: write
  id-token: write # to enable use of OIDC for npm provenance

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    steps:
      - name: Only on main
        if: github.ref != 'refs/heads/main'
        shell: bash
        run: |
          echo "Only to be executed on main"
          exit 1

      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          show-progress: false

      - name: Setup Node.js
        uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
        with:
          node-version-file: ".nvmrc"
          cache: "npm"
          cache-dependency-path: "**/package-lock.json"

      - name: Install dependencies
        shell: bash
        run: |
          npm ci --ignore-scripts

      - name: Build
        shell: bash
        run: |
          npm run build

      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.TOKEN_TO_TRIGGER_SUBSEQUENT_WORKFLOWS }}
          NPM_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          npm run release