release.yml

name: Release

on:
  workflow_dispatch:

permissions:
  contents: read
  id-token: write

jobs:
  release:
    runs-on: ubuntu-latest

    steps:
      - name: Ensure release runs on main
        if: github.ref_name != 'main'
        run: |
          echo "Release workflow must be triggered on the main branch."
          exit 1

      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Verify version sync and export version
        id: version
        run: |
          node -e "
          const fs = require('node:fs');
          const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
          const jsr = JSON.parse(fs.readFileSync('jsr.json', 'utf8'));
          if (pkg.version !== jsr.version) {
            throw new Error('package.json and jsr.json versions are not in sync');
          }
          fs.appendFileSync(process.env.GITHUB_OUTPUT, 'value=' + pkg.version + '\n');
          console.log('Version verified:', pkg.version);
          "

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Ensure version is unpublished
        env:
          VERSION: ${{ steps.version.outputs.value }}
        run: |
          if npm view "@sebastianwessel/quickjs@${VERSION}" version >/dev/null 2>&1; then
            echo "Version ${VERSION} is already published on npm."
            exit 1
          fi

      - name: Lint
        run: bun run lint

      - name: Typecheck
        run: bunx tsc --noEmit

      - name: Run tests (serial by file)
        run: |
          set -euo pipefail
          for f in $(find src -type f -name '*.test.ts' | sort); do
            echo "Running $f"
            bun test "$f"
          done

      - name: Build
        run: bun run build

      - name: Publish to npm (trusted publishing)
        env:
          NODE_AUTH_TOKEN: ""
        run: npm publish --provenance --access public --ignore-scripts

      - name: Publish to JSR
        run: npx jsr publish