release.yml

name: Release

on:
  push:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions: {}

# Installs, also nested ones in scripts, skip pnpmfiles. Dependency scripts are skipped
# on the install below; the env leaves them on so publishing keeps its lifecycle scripts.
env:
  pnpm_config_ignore_pnpmfile: "true"

jobs:
  release-pr:
    name: Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
      pull-requests: write

    steps:
      # A GitHub App token instead of GITHUB_TOKEN, so the release pull request
      # triggers the organization Check like any other pull request.
      - name: Create release token
        id: token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

      - name: Checkout
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          fetch-depth: 0
          token: ${{ steps.token.outputs.token }}
          # Keep the token out of .git/config during the install; Changesets
          # pushes through the GitHub API instead (commitMode below).
          persist-credentials: false

      - name: Setup PNPM
        # v6.1.0 is the first release that installs pnpm 12; the v6 tag still points to 6.0.10.
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0

      - name: Setup Node
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version-file: .node-version
          registry-url: https://registry.npmjs.org
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile

      - name: Create release pull request
        id: changesets
        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
        with:
          version: pnpm release
          publish: pnpm release:publish
          commit: "[ci] release"
          title: "[ci] release"
          # Commits and tags go through the GitHub API with the App token, signed
          # and attributed to the App, so no Git credential is needed in the checkout.
          commitMode: github-api
        env:
          GITHUB_TOKEN: ${{ steps.token.outputs.token }}