release.yml

name: Release

# Release on manual trigger only
on:
  workflow_dispatch:

env:
  npmVersion: 8

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}

permissions: {}

jobs:
  build:
    runs-on: ubuntu-latest

    # This environment contains secrets needed for publishing
    environment: release

    steps:
      - name: Check out code
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
        with:
          # Don't save creds in the git config (so it's easier to override later)
          persist-credentials: false

      - name: Install Node.js from .nvmrc
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version-file: .nvmrc

      # Guarantee a predictable version of npm (the PR build tests against both 6 and 8)
      - name: Install package managers
        run: npm install --global npm@${{ env.npmVersion }} yarn@1

      - run: yarn --frozen-lockfile

      - run: yarn build

      - run: yarn test:unit

      - run: yarn test:func

      - name: yarn test:e2e (npm ${{ env.npmVersion }})
        run: yarn test:e2e

      - name: Publish package
        run: |
          git config user.email "kchau@microsoft.com"
          git config user.name "Ken Chau"

          # Get the existing remote URL without creds, and use a trap (like try/finally)
          # to restore it after this step finishes
          trap "git remote set-url origin '$(git remote get-url origin)'" EXIT

          # Add a token to the remote URL for auth during release
          git remote set-url origin "https://$REPO_PAT@github.com/$GITHUB_REPOSITORY"

          yarn release -y -n "$NPM_AUTHTOKEN"
        env:
          NPM_AUTHTOKEN: ${{ secrets.NPM_AUTHTOKEN }}
          REPO_PAT: ${{ secrets.REPO_PAT }}