release.yml

name: Release Windows Installer

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

permissions:
  contents: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  publish:
    runs-on: windows-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.10

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Validate tag matches package version
        shell: pwsh
        run: |
          $pkg = Get-Content package.json -Raw | ConvertFrom-Json
          $expected = "v$($pkg.version)"
          $refName = "${{ github.ref_name }}"
          $fullRef = "${{ github.ref }}"
          $tag = if ($refName -like 'refs/tags/*') {
            $refName.Substring(10)
          } elseif ($fullRef -like 'refs/tags/*') {
            $fullRef.Substring(10)
          } else {
            $refName
          }
          if ($tag -ne $expected) {
            throw "Tag '$tag' does not match package.json version '$expected'"
          }

      - name: Build and publish release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: bun run dist:publish

      - name: Show generated artifacts
        shell: pwsh
        run: Get-ChildItem -Recurse release | Select-Object FullName, Length | Format-Table -AutoSize