release.yml

name: Release

# Publish the versions promoted from dev by a dev-to-master release PR.
# version.yml owns version bumps and changelogs on dev, so this workflow never
# opens pull requests or commits to master. It publishes public package
# versions that are not yet on npm, creates git tags, and creates GitHub
# releases. A push with nothing unpublished is a clean no-op.
#
# A pending changeset on master means dev changed after its Version Packages
# PR merged but before promotion. Publishing that tree would attach the new
# change to a version and changelog that did not include it, so fail before
# installing or publishing anything.
#
# Requires the NPM_TOKEN repo secret: an npm automation token with publish
# rights on the @understudy scope (the org must exist on npm first). Without
# it the publish step fails loudly with ENEEDAUTH — nothing partial happens.
# apps/* are private and never publish. Provenance: id-token: write +
# NPM_CONFIG_PROVENANCE below.

on:
  push:
    branches: [master]

concurrency: release-${{ github.ref }}

permissions:
  contents: write
  id-token: write

jobs:
  release:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      # v5/v6 majors run on the node24 action runtime (changesets/action@v1
      # already does); the v4 majors ran on node20, which GitHub now flags
      # with a deprecation annotation.
      - uses: actions/checkout@v5
        with:
          # Changesets reads history to decide what changed since the last tag.
          fetch-depth: 0

      # Reads the pnpm version from package.json "packageManager".
      - uses: pnpm/action-setup@v6

      - uses: actions/setup-node@v5
        with:
          node-version: 22
          cache: pnpm
          registry-url: https://registry.npmjs.org

      - name: Refuse pending changesets (freeze-window tripwire)
        run: |
          PENDING=$(find .changeset -maxdepth 1 -name '*.md' ! -name 'README.md')
          if [ -n "$PENDING" ]; then
            echo "::error::Unversioned changesets reached master. Merge the regenerated 'Version Packages' PR into dev, then re-cut the release PR (dev -> master)."
            echo "$PENDING"
            exit 1
          fi

      - name: Install (frozen lockfile)
        run: pnpm install --frozen-lockfile

      # prepublishOnly builds each package again at publish time; this build
      # front-loads failures so a broken build never reaches the registry.
      - name: Build publishable packages
        run: pnpm --filter "./packages/*" build

      - name: Publish unpublished versions to npm
        uses: changesets/action@v1
        with:
          publish: pnpm changeset publish
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_CONFIG_PROVENANCE: 'true'