release.yml

name: Release

# Publishes a GitHub release when a version tag is pushed. Tags are not
# branch-protected, so this needs no bypass: `main` stays fully protected. The
# tag is expected to point at a merged release PR (see scripts/release.mjs
# prepare), so the tree is already reviewed and CI-green.
on:
  push:
    tags: ["v*"]

permissions:
  contents: write

jobs:
  release:
    name: Build, test, and publish
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v5
        with:
          node-version: 22
          cache: npm
      - run: npm ci

      # The tag must match the version in package.json, so a stray tag can't
      # publish a release that disagrees with the tree it points at.
      - name: Verify tag matches package.json version
        run: |
          tag="${GITHUB_REF_NAME#v}"
          pkg="$(node -p "require('./package.json').version")"
          if [ "$tag" != "$pkg" ]; then
            echo "::error::tag v$tag does not match package.json version $pkg"
            exit 1
          fi

      - run: npm run lint
      - run: npx tsc --noEmit
      - run: npm test

      # Reuse the changelog as the single source of release notes.
      - name: Extract release notes
        run: node scripts/release.mjs notes "$GITHUB_REF_NAME" > release-notes.md

      - name: Publish GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release create "$GITHUB_REF_NAME" --title "Stacks ${GITHUB_REF_NAME#v}" --notes-file release-notes.md