release.yml

name: release
on:
  push:
    branches:
      - main

jobs:
  release:
    name: Create draft release
    outputs:
      release_created: ${{ steps.release.outputs.release_created }}
      tag_name: ${{ steps.release.outputs.tag_name }}
    runs-on: ubuntu-latest
    steps:
      - uses: googleapis/release-please-action@7987652d64b4581673a76e33ad5e98e3dd56832f # v4
        id: release

  publish-npm:
    name: Publish to npm
    permissions:
      contents: read
      id-token: write
    runs-on: ubuntu-latest
    needs: [release]
    if: ${{ needs.release.outputs.release_created }}
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v3
      - uses: actions/setup-node@v4
        with:
          node-version: "18"
          cache: "pnpm"
      - run: pnpm install --frozen-lockfile
      - name: Configure npm user
        run: npm config set "//registry.npmjs.org/:_authToken=${NPM_TOKEN}"
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
      - run: pnpm publish --access public
        env:
          # https://docs.npmjs.com/generating-provenance-statements#using-third-party-package-publishing-tools
          NPM_CONFIG_PROVENANCE: true