release.yml

name: Release

on:
  release:
    types: [published]

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - run: corepack enable
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm
          registry-url: https://registry.npmjs.org
      - run: pnpm install --frozen-lockfile
      - name: Verify version matches release tag
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          PKG_VERSION="v$(node -p 'require("./package.json").version')"
          if [ "$PKG_VERSION" != "$RELEASE_TAG" ]; then
            echo "::error::package.json version ($PKG_VERSION) does not match release tag ($RELEASE_TAG)"
            exit 1
          fi
      - run: pnpm run check
      - run: pnpm run typecheck
      - run: pnpm run skills:check
      - run: pnpm test
      - run: pnpm run build
      - run: pnpm run package:smoke
      - name: Install trusted-publishing npm client
        run: npm install --global npm@12.0.2
      - run: npm publish --access public