release.yml

name: Release
on:
  release:
    types: [published]

jobs:
  release_to_npm:
    name: Release to npm
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0 # Ensures it gets the tags and history correctly
      - name: Use Node.js 24.x
        uses: actions/setup-node@v6
        with:
          node-version: 24.x
          cache: 'npm'
          cache-dependency-path: 'package-lock.json'
      - run: npm ci
      - run: npm run build-serial
        env:
          NODE_OPTIONS: --max_old_space_size=4096
      - run: npm test
      - run: npm run lint
      - name: Determine npm tag based on release version
        id: get_npm_tag
        run: |
          TAG_NAME="${{ github.ref_name }}"
          NPM_TAG_VALUE="latest" # Default tag

          if [[ "$TAG_NAME" == *alpha* || "$TAG_NAME" == *beta* || "$TAG_NAME" == *pre* ]]; then
            NPM_TAG_VALUE="next"
          fi
          
          echo "NPM_TAG=${NPM_TAG_VALUE}" >> $GITHUB_ENV
          echo "Determined NPM_TAG: ${NPM_TAG_VALUE}"
      - run: npx nx release publish --tag=$NPM_TAG --provenance
        env:
          # This ensures the npm CLI knows which registry to authenticate against using OIDC
          NPM_CONFIG_REGISTRY: "https://registry.npmjs.org/"
          # If using Nx, it also needs the GitHub token for the release side
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # This tells npm to use the OIDC token for the registry
          NODE_AUTH_TOKEN: ${{ steps.get_id_token.outputs.token }}