name: Release

on:
  push:
    branches:
      - master
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      issues: write
      pull-requests: write
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup Bun.js
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest
      # OIDC trusted publishing requires npm CLI >= 11.5.1; ubuntu-latest ships an older one.
      - name: Upgrade npm CLI (for OIDC trusted publishing)
        run: npm install -g npm@latest
      - name: Cache bun dependencies
        id: bun-cache
        uses: actions/cache@v4
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-bun-

      - name: Install/Typecheck/Build
        # We use a `prepare` script that run builds to support git installs.
        run: bun install

      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GIT_AUTHOR_NAME: ${{ github.actor }}
          GIT_AUTHOR_EMAIL: '${{ github.actor }}@users.noreply.github.com'
          GIT_COMMITTER_NAME: ${{ github.actor }}
          GIT_COMMITTER_EMAIL: '${{ github.actor }}@users.noreply.github.com'
        run: bun release