release.yml

# docs: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions

name: Release

on:
  workflow_dispatch:
    inputs:
      newversion:
        # is param from `npm version`. therefore the description should reference all the options from there
        description: 'one of: [<newversion> | major | minor | patch | premajor | preminor | prepatch | prerelease | from-git]'
        required: true
      commitMessage:
        description: 'Release/commit message (%s will be replaced with the resulting version number)'
        default: '%s'
        required: true
      preid:
        description: 'The "prerelease identifier" to use as a prefix for the "prerelease" part of a semver. Like the rc in `1.2.0-rc.8`.'
        type: choice
        options:
          - rc
          - beta
          - alpha
        default: rc
        required: false
      prerelease:
        description: "This is a pre-release"
        type: boolean
        default: false
        required: false

permissions: write-all

env:
  REPORTS_DIR: CI_reports
  PACKED_DIR: CI_packed
  PACKED_ARTIFACT: packed
  NODE_ACTIVE_LTS: "20"

jobs:
  bump:
    name: bump and tag release
    concurrency: release-bump
    outputs:
      version:       ${{ steps.bump.outputs.version }}
      version_plain: ${{ steps.bump.outputs.version_plain }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout code
        # see https://github.com/actions/checkout
        uses: actions/checkout@v4
      - name: Configure Git
        # needed for push back of changes
        run: |
          set -eux
          git config --local user.email "${GITHUB_ACTOR}@users.noreply.github.com"
          git config --local user.name "${GITHUB_ACTOR}"
      - name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }}
        # see https://github.com/actions/setup-node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_ACTIVE_LTS }}
      ## ! no npm build at the moment
      - name: bump VERSION
        id: bump
        run: |
          set -eux
          COMMIT_SIG="Signed-off-by: $(git config user.name) <$(git config user.email)>"
          VERSION="$( npm version "$NPMV_NEWVERSION" --message "$NPMV_MESSAGE"$'\n\n'"$COMMIT_SIG" --preid "$NPMV_PREID" )"
          echo "::debug::new version = $VERSION"
          VERSION_PLAIN="${VERSION:1}" # remove 'v' prefix
          echo "::debug::plain version = $VERSION_PLAIN"
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "version_plain=$VERSION_PLAIN" >> $GITHUB_OUTPUT
        env:
          NPMV_NEWVERSION: ${{ github.event.inputs.newversion }}
          NPMV_MESSAGE: ${{ github.event.inputs.commitMessage }}
          NPMV_PREID: ${{ github.event.inputs.preid }}
      - name: git push back
        run: git push --follow-tags

  publish-package:
    needs:
      - "bump"
    name: publish package
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      PACKAGE_RELEASE_TAG: ${{ github.event.inputs.prerelease == 'true' && 'unstable-prerelease' || 'latest' }}
    steps:
      - name: Checkout code
        # see https://github.com/actions/checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ needs.bump.outputs.version }}
      - name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }}
        # see https://github.com/actions/setup-node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_ACTIVE_LTS }}
      - name: install build tools
        run: npm i --ignore-scripts --include=optional --loglevel=silly
      # no explicit npm build. if a build is required, it should be configured as prepublish/prepublishOnly script of npm.
      - name: login to registries
        run: |
          npm config set "//registry.npmjs.org/:_authToken=$NPM_TOKEN"
          npm config set "//npm.pkg.github.com/:_authToken=$GITHUB_TOKEN"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
      - name: publish to NPMJS as "${{ env.PACKAGE_RELEASE_TAG }}"
        run: >
          npm publish
          --@cyclonedx:registry='https://registry.npmjs.org'
          --provenance
          --access public 
          --tag "$PACKAGE_RELEASE_TAG"
      - name: publish to GitHub as "${{ env.PACKAGE_RELEASE_TAG }}"
        run: >
          npm publish
          --@cyclonedx:registry='https://npm.pkg.github.com'
          --provenance
          --access public 
          --tag "$PACKAGE_RELEASE_TAG"
      - name: pack release result
        run: |
          mkdir -p "$PACKED_DIR"
          npm pack --pack-destination "$PACKED_DIR"
      - name: artifact release result
        # see https://github.com/actions/upload-artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.PACKED_ARTIFACT }}
          path: ${{ env.PACKED_DIR }}/
          if-no-files-found: error

  release-GH:
    needs:
      - "bump"
      - "publish-package"
    name: publish GitHub
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      ASSETS_DIR: release_assets
    steps:
      - name: fetch release result
        # see https://github.com/actions/download-artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ env.PACKED_ARTIFACT }}
          path: ${{ env.ASSETS_DIR }}
      - name: Create Release
        id: release
        # see https://github.com/softprops/action-gh-release
        uses: softprops/action-gh-release@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name:   ${{ needs.bump.outputs.version }}
          name:       ${{ needs.bump.outputs.version_plain }}
          prerelease: ${{ github.event.inputs.prerelease }}
          files:      ${{ env.ASSETS_DIR }}/*