release.yml

name: Release

on:
  push:
    branches:
      - main
      - beta

permissions:
  contents: write # Required for creating releases and pushing tags
  issues: write # Required for semantic-release to create issues on failure
  pull-requests: write # Required for semantic-release to comment on PRs
  id-token: write # Required for NPM provenance

jobs:
  release:
    runs-on: ubuntu-latest
    
    steps:
    - name: Checkout
      uses: actions/checkout@v4
      with:
        fetch-depth: 0
        persist-credentials: false
    
    - name: Use Node.js 18.x
      uses: actions/setup-node@v4
      with:
        node-version: 18.x
        cache: 'npm'
    
    - name: Install dependencies
      run: npm ci
    
    - name: Run tests
      run: npm test
    
    - name: Run linter
      run: npm run lint
    
    - name: Run security audit (prod deps)
      run: npm audit --audit-level=high --omit=dev
    
    - name: Release
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        HUSKY: 0 # Disable husky hooks for automated semantic-release commits
      run: npx semantic-release