release.yml

name: Release

# Release on manual trigger only
on:
  workflow_dispatch:

env:
  nodeVersion: 24
  npmVersion: 11

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}

permissions: {}

jobs:
  build:
    runs-on: ubuntu-latest

    # This environment contains secrets needed for publishing
    environment: release

    permissions:
      # for trusted publishing
      id-token: write

    steps:
      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          # Don't save creds in the git config (so it's easier to override later)
          persist-credentials: false

      # Prereleases from main are disabled until the canary/prerelease flow is fixed
      - name: Verify v2 branch
        run: |
          if [[ "${GITHUB_REF}" != "refs/heads/v2" ]]; then
            echo "Releases can only be triggered from the v2 branch."
            exit 1
          fi

      - name: Install Node.js ${{ env.nodeVersion }}
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: ${{ env.nodeVersion }}

      - name: Install npm@${{ env.npmVersion }}
        run: npm install --global npm@${{ env.npmVersion }}

      - run: yarn --immutable

      - run: yarn build --verbose

      - run: yarn test --verbose

      # TODO (release): switch back to regular release
      - name: Publish package (canary)
        run: |
          git config user.email "kchau@microsoft.com"
          git config user.name "Ken Chau"

          # Get the existing remote URL without creds, and use a trap (like try/finally)
          # to restore it after this step finishes
          trap "git remote set-url origin '$(git remote get-url origin)'" EXIT

          # Add a token to the remote URL for auth during release
          git remote set-url origin "https://$REPO_PAT@github.com/$GITHUB_REPOSITORY"

          yarn release:canary
        env:
          REPO_PAT: ${{ secrets.REPO_PAT }}