release-on-npm.yaml

name: Release on NPM

on:
    push:
        tags:
            - 'v3.*.*'

permissions:
    id-token: write # Required for OIDC
    contents: read

concurrency:
    group: release-on-npm-${{ github.ref_name }}
    cancel-in-progress: false

jobs:
    release:
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
              with:
                  ref: ${{ github.ref }}
                  persist-credentials: false
                  fetch-depth: 0

            - name: Verify tag is on the matching release branch
              run: |
                  set -euo pipefail
                  MAJOR="${GITHUB_REF_NAME#v}"
                  MAJOR="${MAJOR%%.*}"
                  BRANCH="${MAJOR}.x"
                  git fetch --no-tags origin "refs/heads/${BRANCH}:refs/remotes/origin/${BRANCH}"
                  if ! git merge-base --is-ancestor "${GITHUB_SHA}" "refs/remotes/origin/${BRANCH}"; then
                      echo "::error::Tag ${GITHUB_REF_NAME} (${GITHUB_SHA}) is not an ancestor of branch ${BRANCH}. Refusing to publish."
                      exit 1
                  fi
                  echo "Tag ${GITHUB_REF_NAME} verified as ancestor of ${BRANCH}."

            - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
              # setup-node does not enable any package-manager cache here (no `cache:` input),
              # so cache poisoning is not a concern on this release workflow.
            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # zizmor: ignore[cache-poisoning] v7.0.0
              with:
                  registry-url: 'https://registry.npmjs.org'
                  node-version-file: '.nvmrc'

            - name: Install root JS dependencies
              run: pnpm install --frozen-lockfile

            - name: Build JS assets
              run: pnpm run build

            - name: Verify dist files match committed sources
              run: |
                  if ! git diff --quiet; then
                      echo "::error::Built dist files differ from the committed ones at tag ${GITHUB_REF_NAME}. Refusing to publish."
                      git status --porcelain
                      git diff
                      exit 1
                  fi
                  echo "Built dist files match the committed ones."

            - name: Publish on NPM
              run: pnpm publish --recursive --access public --no-git-checks --provenance