release.yml

name: Release

# Cutting a release: publish a GitHub Release whose tag is vMAJOR.MINOR.PATCH,
# with the release notes in the body. This workflow derives the version from
# the tag, writes it into package.json and CHANGELOG.md on main, publishes to
# npm, and pushes the "Release vX.Y.Z" commit back to main. Tag the latest main
# so the published package matches what lands on the branch.
#
# workflow_dispatch runs a packaging dry-run only (no version bump, no publish).

on:
  release:
    types: [published]
  workflow_dispatch:

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: write # push the Release commit back to main
      id-token: write # npm provenance
    steps:
      - uses: actions/checkout@v4
        with:
          ref: main
          fetch-depth: 0

      - uses: actions/setup-node@v4
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org
          cache: npm

      # Tokenless trusted publishing needs npm >= 11.5.1; the version bundled
      # with Node ships older, so pull the latest npm explicitly.
      - name: Upgrade npm for trusted publishing
        run: npm install -g npm@latest

      - name: Resolve version from the release tag
        id: version
        if: github.event_name == 'release'
        run: |
          tag="${GITHUB_REF_NAME}"
          version="${tag#v}"
          if ! echo "$version" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
            echo "::error::Release tag '$tag' is not vMAJOR.MINOR.PATCH"
            exit 1
          fi
          echo "value=$version" >> "$GITHUB_OUTPUT"

      - run: npm ci

      - name: Bump package.json to the release version
        if: github.event_name == 'release'
        run: npm version "${{ steps.version.outputs.value }}" --no-git-tag-version --allow-same-version

      # Prepend the release body to CHANGELOG.md, inserted after the marker line.
      # NOTES comes in through the environment so arbitrary markdown needs no
      # shell escaping.
      - name: Update CHANGELOG.md
        if: github.event_name == 'release'
        env:
          VERSION: ${{ steps.version.outputs.value }}
          NOTES: ${{ github.event.release.body }}
        run: |
          date="$(date -u +%Y-%m-%d)"
          {
            printf '## v%s (%s)\n\n' "$VERSION" "$date"
            printf '%s\n' "${NOTES:-_No release notes._}"
          } > "$RUNNER_TEMP/entry.md"
          awk '
            { print }
            /^<!-- releases below -->$/ && !done {
              print ""
              while ((getline line < (ENVIRON["RUNNER_TEMP"] "/entry.md")) > 0) print line
              done = 1
            }
          ' CHANGELOG.md > CHANGELOG.next
          mv CHANGELOG.next CHANGELOG.md

      # Idempotent: skip if the version is already published, so a release can be
      # re-run without failing on a version conflict. prepublishOnly runs tests.
      - name: Publish to npm
        if: github.event_name == 'release'
        run: |
          VERSION="${{ steps.version.outputs.value }}"
          if npm view "@gettyimages/git-fi@${VERSION}" version >/dev/null 2>&1; then
            echo "@gettyimages/git-fi@${VERSION} already published — skipping npm publish."
          else
            npm publish --provenance --access public
          fi

      - name: Commit version and changelog to main
        if: github.event_name == 'release'
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add package.json package-lock.json CHANGELOG.md
          if git diff --cached --quiet; then
            echo "No version or changelog changes to commit."
          else
            git commit -m "Release v${{ steps.version.outputs.value }}"
            git push origin main
          fi

      # workflow_dispatch: validate packaging without uploading.
      - name: Publish (dry run)
        if: github.event_name == 'workflow_dispatch'
        run: npm publish --dry-run --access public