release.yml

name: Release

# Release on manual trigger only
on:
  workflow_dispatch:

# Use newer node and npm for trusted publishing support. Can't use node 22 yet because of test issues.
# (`npm login` hangs with the current verdaccio version; this is fixed in latest verdaccio, but it's
# not compatible with old node)
env:
  nodeVersion: 20
  npmVersion: 11

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}

permissions: {}

jobs:
  build:
    runs-on: ubuntu-latest

    # This environment contains secrets needed for publishing
    environment: release

    permissions:
      # for trusted publishing
      id-token: write

    steps:
      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          # Don't save creds in the git config (so it's easier to override later)
          persist-credentials: false

      - name: Install Node.js ${{ env.nodeVersion }}
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: ${{ env.nodeVersion }}

      - name: Install npm@${{ env.npmVersion }}
        run: npm install --global npm@${{ env.npmVersion }}

      - run: yarn --frozen-lockfile

      - run: yarn build --verbose

      - run: yarn test --verbose

      - name: Publish package
        run: |
          git config user.email "kchau@microsoft.com"
          git config user.name "Ken Chau"

          # Get the existing remote URL without creds, and use a trap (like try/finally)
          # to restore it after this step finishes
          trap "git remote set-url origin '$(git remote get-url origin)'" EXIT

          # Add a token to the remote URL for auth during release
          git remote set-url origin "https://$REPO_PAT@github.com/$GITHUB_REPOSITORY"

          yarn release
        env:
          REPO_PAT: ${{ secrets.REPO_PAT }}