publish-typist-package-release.yml

name: Typist Package Release

on:
    workflow_run:
        workflows:
            - CI Validation
        branches:
            - main
        types:
            - completed

permissions:
    # Enable the use of OIDC for npm provenance
    id-token: write
    # Enable the use of GitHub Packages registry
    packages: write
    # Enable `semantic-release` to publish a GitHub release and post comments on issues/PRs
    contents: write
    issues: write
    pull-requests: write

# The release workflow involves many crucial steps that once triggered it shouldn't be cancelled
# until it's finished, otherwise we might end up in an inconsistent state (e.g., a new release
# published to npm but not GitHub Packages). To prevent this, concurrency is disabled with
# `cancel-in-progress: false`, and new workflow runs will be queued to be started only when the
# previous one has completely finished.
concurrency:
    group: typist-package-release
    cancel-in-progress: false

jobs:
    release-and-publish:
        name: Release & Publish
        runs-on: ubuntu-latest
        timeout-minutes: 60

        if: github.event.workflow_run.conclusion == 'success'

        steps:
            - name: Checkout repository
              uses: actions/checkout@v4
              with:
                  token: ${{ secrets.GH_REPO_TOKEN }}

            - name: Prepare Node.js environment
              uses: actions/setup-node@v3
              with:
                  cache: npm
                  node-version-file: .node-version

            - name: Cache project 'node_modules' directory
              uses: actions/cache@v3
              id: node-modules-cache
              with:
                  key: node-modules-cache-${{ hashFiles('**/package-lock.json', '**/.node-version') }}
                  path: node_modules/

            - name: Install project npm dependencies
              if: ${{ steps.node-modules-cache.outputs.cache-hit != 'true' }}
              run: |
                  npm ci

            - name: Build package
              run: |
                  npm run build

            - name: Run automated package publishing
              id: semantic-release
              run: |
                  npx semantic-release
              env:
                  GITHUB_TOKEN: ${{ secrets.GH_REPO_TOKEN }}
                  NPM_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
                  GIT_AUTHOR_EMAIL: doistbot@users.noreply.github.com
                  GIT_AUTHOR_NAME: Doist Bot
                  GIT_COMMITTER_EMAIL: doistbot@users.noreply.github.com
                  GIT_COMMITTER_NAME: Doist Bot

            - name: Remove Doist registry configuration from `.npmrc`
              if: ${{ steps.semantic-release.outputs.package-published == 'true' }}
              run: |
                  npm config delete @doist:registry --location=project

            - name: Prepare Node.js environment for GitHub Packages
              uses: actions/setup-node@v3
              if: ${{ steps.semantic-release.outputs.package-published == 'true' }}
              with:
                  cache: npm
                  node-version-file: .node-version
                  registry-url: https://npm.pkg.github.com/
                  scope: '@doist'

            - name: Disable npm package provenance (unsupported by GitHub Packages)
              if: ${{ steps.semantic-release.outputs.package-published == 'true' }}
              run: |
                  npm config set provenance false --location=project

            - name: Publish package to GitHub Packages
              if: ${{ steps.semantic-release.outputs.package-published == 'true' }}
              run: |
                  npm publish
              env:
                  NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}