release.yml

name: Release
on:
  # Can be run manually
  workflow_dispatch:
    inputs:
      skip-tests:
        description: Skip test
        type: boolean
        default: false

  # on git push
  push:
    branches:
      - main

# Only one run at a time
concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

jobs:
  test:
    if: >
      !contains(github.event.head_commit.message, 'no-release') &&
      (
        (github.event_name == 'workflow_dispatch' && github.event.inputs.skip-tests != 'true') ||
        (
          github.event_name == 'push' &&
          !(
            contains(github.event.head_commit.message, 'no-test') ||
            (
              startsWith(github.event.head_commit.message, 'Merge pull request') &&
              contains(github.event.head_commit.message, '/dev')
            )
          )
        )
      )
    uses: ./.github/workflows/test.yml

  release:
    needs: test
    # `always()` because `needs` alone would block this whenever `test` is *skipped*, which is the
    # normal path for a `no-test` commit or a merge from /dev. This one condition replaces the pair
    # of mirror-image jobs that used to be here - `release_after_test` with `needs: test`, and
    # `release` with the test condition negated - which meant the release call was written down
    # twice and the two conditions had to be kept in step by hand.
    if: >
      always() && !cancelled() &&
      (needs.test.result == 'success' || needs.test.result == 'skipped') &&
      !contains(github.event.head_commit.message, 'no-release')
    uses: panates/github-actions/.github/workflows/node-release.yaml@v3
    with:
      # **`npm run build`, not the default `rman build`.** No package here declares a `build`
      # script - only the root does, and it is an `echo`. Under rman 2 the monorepo root's own
      # script no longer counts toward the script being defined, so `rman build` fails outright
      # with `No package defines a "build" script.` (measured: it failed this repository's first
      # @v3 release, after Version had already bumped and pushed). Same rule that made
      # `rman run qc` in test.yml become `npm run qc`.
      build_script: 'npm run build'
    # Declared on the calling job because that is what governs a reusable workflow's own
    # permissions. `contents: write` is what `rman version --push` and the GitHub Release need;
    # `id-token: write` is only used if this repo switches to npm Trusted Publishing, and costs
    # nothing while NPM_TOKEN is still being passed.
    permissions:
      id-token: write
      contents: write
    secrets:
      # PERSONAL_ACCESS_TOKEN is no longer passed: it became optional in @v3, and this repo has
      # nothing for it to authenticate - every package publishes to npmjs.org and nothing is
      # pulled from npm.pkg.github.com. The checkout and the version push use the job's own
      # GITHUB_TOKEN, which is also why a release does not trigger a second run of itself.
      #
      # NPM_TOKEN can be dropped too, once each @panates package is registered as a Trusted
      # Publisher on npmjs.com - repository `panates/javascript` (the directory is called
      # panates-javascript, the repository is not), workflow filename `release.yml`, which is
      # *this* file rather than the reusable one it calls. See
      # https://github.com/panates/github-actions/blob/v3/docs/node-release.md
      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}