release.yml

name: Release

on:
  push:
    tags: ["v*"]

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - uses: actions/setup-node@v7
        with:
          node-version: "22"
          cache: npm

      # The tag is the release, and `pend-analytics --version` reads package.json.
      # If those disagree, everyone who pinned the tag gets a build that
      # misreports its own version, so fail before the release exists.
      - name: Check the tag matches package.json
        run: |
          tag="${GITHUB_REF_NAME#v}"
          pkg="$(node -p "require('./package.json').version")"
          if [ "$tag" != "$pkg" ]; then
            echo "::error::tag v$tag does not match package.json version $pkg"
            exit 1
          fi
          echo "tag v$tag matches package.json"

      # A tag can be placed on any commit, not only one CI has seen, so the full
      # gate runs again here rather than trusting the branch.
      - run: npm ci

      - name: Typecheck
        run: npm run typecheck

      - name: Lint
        run: npm run lint

      - name: Test
        run: npm test

      - name: Build
        run: npm run build

      # Consumers install from a git tag, so the packed tarball is what they
      # actually get. This fails if `files` omits something the package needs.
      - name: Check the package contents
        run: npm pack --dry-run

      # Body comes from docs/releases/vX.Y.Z.md so every tag uses the same
      # headed format. --generate-notes is not a fallback.
      - name: Publish the GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          notes="docs/releases/${GITHUB_REF_NAME}.md"
          if [ ! -f "$notes" ]; then
            echo "::error::missing $notes - write it from docs/releasing.md"
            exit 1
          fi
          gh release create "$GITHUB_REF_NAME" \
            --title "$GITHUB_REF_NAME" \
            --notes-file "$notes" \
            --verify-tag