release.yml

name: Release

on:
  workflow_dispatch:
  workflow_run:
    workflows: [CI]
    types: [completed]
    branches: [main]

concurrency:
  group: ${{ github.ref }}-release

permissions:
  actions: read

jobs:
  release:
    # Only run this if it's a workflow_dispatch trigger or the CI workflow was successful
    if: ${{ github.event.workflow_run == null || github.event.workflow_run.conclusion == 'success' }}

    runs-on: ubuntu-latest

    # This environment contains secrets needed for publishing and is only accessible to main builds
    environment: release

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          fetch-depth: 0
          # Don't save creds in the git config (so it's easier to override later)
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
        with:
          cache: yarn
          node-version-file: .nvmrc

      - run: yarn --frozen-lockfile

      - name: Check if release is needed
        uses: ecraig12345/beachball-actions/should-release@1efe39b3d3f845f8714a6ef1d9d31e14562c225c # v2
        id: shouldRelease
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          batch: true
          mode: output
          changeGlob: '.changeset/*.md'

      - name: Release
        if: ${{ steps.shouldRelease.outputs.shouldRelease == 'yes' }}
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
        env:
          # Used by changesets and when pushing updates
          GITHUB_TOKEN: ${{ secrets.REPO_PAT }}
        with:
          # Used to authenticate the `github` object (used for creating the release)
          github-token: ${{ secrets.REPO_PAT }}
          script: |
            const release = require('./scripts/release/index.cjs');
            await release(github);