release.yml

name: "Release"
on:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: write
  packages: write
  pull-requests: write

jobs:
  release:
    runs-on: ubuntu-latest

    steps:
      - uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
        with:
          egress-policy: audit

      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
        with:
          node-version: 20
          always-auth: true
          registry-url: "https://registry.npmjs.org"

      - name: Install dependencies
        run: yarn --frozen-lockfile

      - name: Run checks
        run: yarn run test && yarn lint && yarn build

      - name: Get app installation token
        uses: npalm/action-app-token@dd4bb16d91ced5659bc618705c96b822c5a42136 # v1.1.0
        id: app-token
        with:
          appId: ${{ secrets.APP_ID }}
          appPrivateKeyBase64: ${{ secrets.APP_PRIVATE_KEY_BASE64 }}
          appInstallationType: repo
          appInstallationValue: ${{ github.repository }}

      - uses: google-github-actions/release-please-action@e4dc86ba9405554aeba3c6bb2d169500e7d3b4ee # v4.1.1
        id: release
        with:
          token: ${{ steps.app-token.outputs.token }}
          release-type: node
          package-name: action-docs
          changelog-types: '[{"type":"feat","section":"Features","hidden":false},{"type":"fix","section":"Bug Fixes","hidden":false},{"type":"chore","section":"Miscellaneous","hidden":false},{"type":"build","section":"Miscellaneous","hidden":true}]'

      - name: Publish to NPM
        run: yarn publish
        if: ${{ steps.release.outputs.release_created }}
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}