release.yml

name: Release and publish to npm
on:
  workflow_dispatch:
    inputs:
      input_version:
        type: choice
        description: What type of release?
        options:
          - patch
          - minor
          - major

concurrency: ${{ github.workflow }}-${{ github.ref }}

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ssh-key: ${{ secrets.BOT_SSH_PRIVATE_KEY }}
      - name: Debug inputs
        run: |
          echo "Type of release:${{ github.event.inputs.input_version }} from user ${GITHUB_ACTOR}"
          git config --list
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: lts/*
      - name: Cache node_modules
        id: node-modules
        uses: actions/cache@v4
        with:
          path: |
            node_modules
            example/node_modules
            .yarn/cache
          key: node-modules
      - name: Import GPG key
        id: import-gpg
        uses: crazy-max/ghaction-import-gpg@v6
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          git_user_signingkey: true
          git_commit_gpgsign: true

      - name: GPG user IDs
        run: |
          echo "fingerprint: ${{ steps.import-gpg.outputs.fingerprint }}"
          echo "keyid:       ${{ steps.import-gpg.outputs.keyid }}"
          echo "name:        ${{ steps.import-gpg.outputs.name }}"
          echo "email:       ${{ steps.import-gpg.outputs.email }}"

      - name: git config
        run: |
          git config user.name "${{ steps.import-gpg.outputs.name }}"
          git config user.email "${{ steps.import-gpg.outputs.email }}"

      - name: Install dependencies
        run: corepack enable && yarn install

      - name: Authenticate with registry
        run: npm config set //registry.npmjs.org/:_authToken $NPM_TOKEN
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Run release-it
        run: npx release-it ${{ github.event.inputs.input_version }} --ci
        env:
          BOT_GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}

      - name: Attest
        uses: actions/attest-build-provenance@v1
        with:
          subject-path: '${{ github.workspace }}/*.tgz'