ci(PLAY-1498 ): migrate CI to GitHub Actions and publish npm on releases

.github/workflows/pr.yml

@@ -1,21 +1,21 @@
-name: "Lint PR"
+name: pr
+on: [pull_request]
 
-on:
-  pull_request_target:
-    types:
-      - opened
-      - edited
-      - synchronize
-      - reopened
-
-permissions:
-  pull-requests: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
-  main:
-    name: Validate PR title
+  # build all assets for CI context
+  build:
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@v5
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: "npm"
+      - run: npm ci
+      - run: npx tsc --version
+      - run: npm run lint
+      - run: npm run build

.github/workflows/prereleased.yml

@@ -0,0 +1,13 @@
+name: prereleased
+on:
+  release:
+    types: [prereleased]
+
+jobs:
+  release-canary:
+    uses: ./.github/workflows/release-channel.yml
+    with:
+      channel: canary
+      tag: ${{ github.event.release.tag_name }}
+    secrets:
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/release-channel.yml

@@ -0,0 +1,72 @@
+name: release-channel
+on:
+  workflow_call:
+    secrets:
+      NPM_TOKEN:
+        required: false # not needed for dry runs
+    inputs:
+      tag:
+        required: true
+        type: string
+        description: the release tag to publish to npm (e.g. v2.7.0)
+      channel:
+        required: true
+        type: string
+        description: the channel canary|stable to publish to
+      dry_run:
+        required: false
+        type: boolean
+        description: pack and validate everything without publishing to npm
+        default: false
+
+  workflow_dispatch:
+    inputs:
+      tag:
+        required: true
+        type: string
+        description: the release tag to publish to npm (e.g. v2.7.0)
+      channel:
+        required: true
+        type: choice
+        options:
+          - canary
+          - stable
+        description: the channel canary|stable to publish to
+      dry_run:
+        required: false
+        type: boolean
+        description: pack and validate everything without publishing to npm
+        default: false
+
+jobs:
+  npm-publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag }}
+      - name: confirm package.json version matches tag
+        run: |
+          version=$(jq -r '.version' package.json)
+          tag_version="${TAG#v}"
+          echo "package.json version: $version, tag: $TAG"
+          if [ "$version" != "$tag_version" ]; then
+            echo "package.json version ($version) does not match tag ($tag_version)" >&2
+            exit 1
+          fi
+        env:
+          TAG: ${{ inputs.tag }}
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: "npm"
+      - run: echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > ~/.npmrc
+      - run: npm ci
+
+      - name: npm-publish-canary
+        if: ${{ inputs.channel == 'canary' }}
+        run: npm publish --tag=next ${{ inputs.dry_run && '--dry-run' || '' }}
+
+      - name: npm-publish-stable
+        if: ${{ inputs.channel == 'stable' }}
+        run: npm publish ${{ inputs.dry_run && '--dry-run' || '' }}

.github/workflows/released.yml

@@ -0,0 +1,13 @@
+name: released
+on:
+  release:
+    types: [released]
+
+jobs:
+  release-stable:
+    uses: ./.github/workflows/release-channel.yml
+    with:
+      channel: stable
+      tag: ${{ github.event.release.tag_name }}
+    secrets:
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/semantic-pr.yml

@@ -0,0 +1,21 @@
+name: "Lint PR"
+
+on:
+  pull_request:
+    types:
+      - opened
+      - edited
+      - synchronize
+      - reopened
+
+permissions:
+  pull-requests: read
+
+jobs:
+  main:
+    name: Validate PR title
+    runs-on: ubuntu-latest
+    steps:
+      - uses: amannn/action-semantic-pull-request@v5
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}