name: Release

on:

push:

branches:

- main

env:

NODE_VERSION: 24.19.0

jobs:

release:

name: Release

runs-on: ubuntu-latest

# Required by changesets/action v2 to commit version changes and open the

# release PR. Declaring them explicitly also drops every other permission

# the default token would otherwise carry.

permissions:

contents: write

pull-requests: write

# Lets the job mint the OIDC token npm exchanges for short-lived publish

# credentials. Without it, npm silently falls back to looking for a token.

id-token: write

steps:

- name: Checkout Repo

uses: actions/checkout@v7.0.1

with:

# Fetch all git history for correct changelog commits

fetch-depth: 0

- name: Use Node.js ${{ env.NODE_VERSION }}

uses: actions/setup-node@v7.0.0

with:

node-version: ${{ env.NODE_VERSION }}

cache: 'npm'

# Required for trusted publishing, not just for tokens: npm only

# attempts the OIDC exchange when an .npmrc points at the registry.

# Omitting this makes publishes fail as though unauthenticated.

registry-url: 'https://registry.npmjs.org'

- name: Install Dependencies

run: npm ci

- name: Run Preprocess

run: npm run preprocess

- name: Run Build

run: npm run build

# No npm credentials are passed here. `changeset publish` shells out to

# `npm publish`, which detects the OIDC environment and authenticates

# itself against the trusted publisher configured on npmjs.com. That

# config names this file, so renaming or splitting this workflow means

# updating the package settings on npm to match.

#

# v2 removed support for passing a token via GITHUB_TOKEN. The

# `github-token` input defaults to the GitHub-provided token, which is

# what this workflow used before, so it is left unset.

- name: Create Release Pull Request or Publish to npm

uses: changesets/action@v2.1.2

with:

publish-script: npm run release

version-script: npm run version

pr-title: 'Publish Next Version'

commit-message: 'Publish Next Version'