release.yml

name: Release

on:
  release:
    types: [published]

permissions:
  contents: read

env:
  NODE_OPTIONS: --max-old-space-size=4096

jobs:
  version:
    runs-on: ubuntu-latest
    outputs:
      result: ${{ steps.version.outputs.result }}
    steps:
      - id: version
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          script: |
            const tag = "${{ github.event.release.tag_name }}";
            const semver = tag.replace('v', '');
            if (semver.match(/^[0-9]+\.[0-9]+\.[0-9]+$/)) {
                return semver
            }
            throw new Error('not semver, ref: ${context.ref}')
          result-encoding: string

  npm:
    name: Release NPM
    runs-on: ubuntu-latest
    needs: version
    environment: NPM Crypto Frontmatter
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
        with:
          node-version-file: '.nvmrc'

      - run: corepack enable pnpm

      - run: pnpm install --frozen-lockfile

      - run: pnpm -r exec pnpm version ${{ needs.Version.outputs.result }} --git-tag-version=false

      - run: pnpm turbo run build --filter "./packages/*"

      - run: npm config set "//registry.npmjs.org/:_authToken" "\${CRYPTO_FRONTMATTER_NPM_TOKEN}" --location=global

      - run: pnpm -r publish --access public --tag latest --no-git-checks
        env:
          CRYPTO_FRONTMATTER_NPM_TOKEN: ${{ secrets.CRYPTO_FRONTMATTER_NPM_TOKEN }}
      #          NPM_CONFIG_PROVENANCE: true

      - run: npm config delete "//registry.npmjs.org/:_authToken" --location=global
        if: always()