release.yml

name: Release

# Manually-triggered "Release" button — pick a bump type in the Actions tab.
# Bumps package.json's version, commits it to a new release/vX.Y.Z branch,
# and opens a PR into master. master has branch protection requiring all
# changes go through a PR with a passing "ci" check, so this workflow can't
# push directly to it — merging the generated PR is what actually lands the
# bump. tag-release.yml (triggered by that merge) creates the git tag, which
# in turn triggers publish.yml (npm) and deploy-pages.yml (GitHub Pages).
on:
  workflow_dispatch:
    inputs:
      bump:
        description: "Version bump type"
        required: true
        type: choice
        options:
          - patch
          - minor
          - major

permissions:
  contents: write
  pull-requests: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          token: ${{ secrets.RELEASE_TAG_PAT }}

      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: "24"

      - name: Bump version
        id: bump
        run: |
          npm version ${{ inputs.bump }} --no-git-tag-version
          echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT"

      # Uses RELEASE_TAG_PAT (not the default GITHUB_TOKEN) for the checkout, push, and
      # PR creation: GitHub now requires manual approval before running workflows (like
      # the "ci" check master's branch protection requires) on PRs authored by
      # github-actions[bot], even for same-repo branches. Authoring the PR as the PAT's
      # user instead avoids that approval step so CI runs immediately.
      - name: Commit to release branch and open PR
        env:
          GH_TOKEN: ${{ secrets.RELEASE_TAG_PAT }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git checkout -b "release/v${{ steps.bump.outputs.version }}"
          git commit -am "chore: release v${{ steps.bump.outputs.version }}"
          git push origin "release/v${{ steps.bump.outputs.version }}"
          gh pr create \
            --base master \
            --head "release/v${{ steps.bump.outputs.version }}" \
            --title "chore: release v${{ steps.bump.outputs.version }}" \
            --body "Merging this PR bumps the published version to v${{ steps.bump.outputs.version }}. Once merged, tag-release.yml tags the commit, which triggers the npm publish and GitHub Pages deploy workflows automatically."