release.yaml

name: release

on:
  workflow_dispatch:
  release:
    types: [released]

# OIDC trusted publishing to npm requires id-token: write so the job can mint
# the OIDC token that npm exchanges for a short-lived publish credential. No
# long-lived NPM_TOKEN is needed and provenance attestations are generated.
permissions:
  contents: read
  id-token: write

jobs:
  build:

    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v6
    - name: Enable corepack
      run: corepack enable
    - name: Use Node.js
      uses: actions/setup-node@v6
      with:
        node-version: 24
        cache: 'pnpm'

    - name: Install Dependencies
      run: pnpm install --frozen-lockfile

    - name: Build
      run: pnpm build

    - name: Test Services
      run: pnpm test:services:start

    - name: Wait for Services
      run: sleep 5

    - name: Testing
      run: pnpm test

    - name: Publish
      run: pnpm publish:packages