main.yml

name: CI & Release

on:
  pull_request:
  push:
    branches: [main]
    tags:
      - v*

concurrency:
  # On PRs builds will cancel if new pushes happen before the CI completes, as it defines `github.head_ref` and gives it the name of the branch the PR wants to merge into
  # Otherwise `github.run_id` ensures that you can quickly merge a queue of PRs without causing tests to auto cancel on any of the commits pushed to main.
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read # for checkout

jobs:
  lint:
    runs-on: ubuntu-latest
    name: Lint
    steps:
      - name: Check out code
        uses: actions/checkout@v3
      - name: Read .tool-versions
        id: versions
        uses: marocchino/tool-versions-action@v1
      - name: Install pnpm
        uses: pnpm/action-setup@v2
        with:
          version: ${{ steps.versions.outputs.pnpm }}
      - name: Install node
        uses: actions/setup-node@v3
        with:
          cache: pnpm
          node-version: ${{ steps.versions.outputs.nodejs }}
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Lint
        run: pnpm run lint
      - name: Build
        run: pnpm run prepublishOnly
      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  test:
    runs-on: ubuntu-latest
    name: Test
    steps:
      - name: Check out code
        uses: actions/checkout@v3
      - name: Read .tool-versions
        id: versions
        uses: marocchino/tool-versions-action@v1
      - name: Install pnpm
        uses: pnpm/action-setup@v2
        with:
          version: ${{ steps.versions.outputs.pnpm }}
      - name: Install node
        uses: actions/setup-node@v3
        with:
          cache: pnpm
          node-version: ${{ steps.versions.outputs.nodejs }}
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Run tests
        run: pnpm test

  build:
    runs-on: ubuntu-latest
    name: Build
    steps:
      - name: Check out code
        uses: actions/checkout@v3
      - name: Read .tool-versions
        id: versions
        uses: marocchino/tool-versions-action@v1
      - name: Install pnpm
        uses: pnpm/action-setup@v2
        with:
          version: ${{ steps.versions.outputs.pnpm }}
      - name: Install node
        uses: actions/setup-node@v3
        with:
          cache: pnpm
          node-version: ${{ steps.versions.outputs.nodejs }}
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Build
        run: pnpm run prepublishOnly
      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  publish:
    needs:
      - lint
      - test
      - build
    permissions:
      contents: write
      issues: write
      pull-requests: write
      id-token: write
    runs-on: ubuntu-latest
    name: Publish
    steps:
      - name: Check out code
        uses: actions/checkout@v3
      - name: Read .tool-versions
        id: versions
        uses: marocchino/tool-versions-action@v1
      - name: Install pnpm
        uses: pnpm/action-setup@v2
        with:
          version: ${{ steps.versions.outputs.pnpm }}
      - name: Install node
        uses: actions/setup-node@v3
        with:
          cache: pnpm
          node-version: ${{ steps.versions.outputs.nodejs }}
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/
      - name: Audit code
        run: pnpm audit signatures
      - name: Authenticate to npm
        run: pnpm config set '//registry.npmjs.org/:_authToken' '${{ secrets.NPM_TOKEN}}'
      - name: Publish package (dry run)
        run: pnpm publish --dry-run --ignore-scripts --no-git-checks
        if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
      - name: Publish package
        run: pnpm publish --ignore-scripts --no-git-checks
        if: ${{ startsWith(github.ref, 'refs/tags/v') }}