release.yml

name: Release

on:
  push:
    branches:
      - main
permissions: {}

jobs:
  release:
    permissions:
      contents: write # to create release (changesets/action)
      id-token: write # OpenID Connect token needed for provenance
      pull-requests: write # to create pull request (changesets/action)
    # prevents this action from running on forks
    if: github.repository == 'sveltejs/vite-plugin-svelte'
    name: Release
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        # pseudo-matrix for convenience, NEVER use more than a single combination
        node: [22]
        os: [ubuntu-latest]
    steps:
      - name: checkout
        uses: actions/checkout@v4
        with:
          # This makes Actions fetch all Git history so that Changesets can generate changelogs with the correct commits
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
      - name: install pnpm
        shell: bash
        run: |
          PNPM_VER=$(jq -r '.packageManager | if .[0:5] == "pnpm@" then .[5:] else "packageManager in package.json does not start with pnpm@\n" | halt_error(1)  end' package.json)
          echo installing pnpm version $PNPM_VER
          npm i -g pnpm@$PNPM_VER
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
          cache: 'pnpm'
          cache-dependency-path: '**/pnpm-lock.yaml'
      - name: install
        run: pnpm install --frozen-lockfile --prefer-offline --ignore-scripts
      - name: generated types are up to date
        run: pnpm generate:types && [ "`git status --porcelain=v1`" == "" ]
      - name: publint
        run: pnpm check:publint
      - name: Creating .npmrc
        run: |
          cat << EOF > "$HOME/.npmrc"
            //registry.npmjs.org/:_authToken=$NPM_TOKEN
          EOF
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
      - name: Create Release Pull Request or Publish to npm
        id: changesets
        # pinned for security, always review third party action code before updating
        uses: changesets/action@c8bada60c408975afd1a20b3db81d6eee6789308 # v1.4.9
        with:
          # This expects you to have a script called release which does a build for your packages and calls changeset publish
          publish: pnpm release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_CONFIG_PROVENANCE: true
      - name: Remove .npmrc
        if: always()
        run: |
          echo "#deleted" > "$HOME/.npmrc"
          rm -f "$HOME/.npmrc"