release.yml

name: Release
on:
  push:
    branches: [main]

concurrency: release-${{ github.ref }}

permissions:
  contents: write
  pull-requests: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        # The tag push in scripts/tag-release.sh must use a PAT, not the
        # default GITHUB_TOKEN: GitHub does NOT fire workflow triggers for tags
        # pushed with GITHUB_TOKEN, so the downstream GoReleaser/Homebrew/notify
        # pipeline would silently never run. Persisting the PAT here makes the
        # `git push origin "${TAG}"` use it.
        with:
          fetch-depth: 0
          token: ${{ secrets.KIT_RELEASE_TOKEN }}
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with: { node-version: 22 }
      - run: npm ci
      # With pending changesets: opens/updates the "Version Packages" PR.
      # With none (the PR just merged): runs the publish script, which pushes
      # the vX.Y.Z tag — and the tag triggers the GoReleaser workflow.
      - uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
        with:
          version: npm run version # changeset version + sync rust/Cargo.toml (lockstep)
          publish: npm run release
        env:
          # A PAT (contents:write + pull-requests:write on this repo) lets the
          # action create the Version Packages PR even while the org forbids
          # Actions-created PRs; falls back to the Actions token otherwise.
          GITHUB_TOKEN: ${{ secrets.KIT_RELEASE_TOKEN || secrets.GITHUB_TOKEN }}