release.yml

name: Release
on:
  push:
    branches: main
concurrency: release
permissions:
  contents: read
jobs:
  ci:
    name: CI
    permissions:
      contents: read
      security-events: write
    uses: ./.github/workflows/ci.yml
  cd:
    name: CD
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs:
      - ci
    permissions:
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6.0.2
        with:
          persist-credentials: false
      - name: Set up node
        uses: actions/setup-node@v6.3.0
        with:
          node-version-file: .nvmrc
          cache: npm
      - name: Install packages
        run: npm ci
      - name: Run build
        run: npm run build
      - name: Generate app token
        id: app-token
        uses: actions/create-github-app-token@v2.2.1
        with:
          app-id: ${{secrets.GH_APP_ID}}
          private-key: ${{secrets.GH_APP_PRIVATE_KEY}}
      - name: Release
        run: npx semantic-release
        env:
          GITHUB_TOKEN: ${{steps.app-token.outputs.token}}
          NPM_TOKEN: ${{secrets.NPM_TOKEN}}