name: Publish

on:
  push:
    branches:
      - main

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions: {}

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write # commit the version bump, push the release tag
      pull-requests: write # open the "Version Packages" PR
      id-token: write # npm publish via OIDC trusted publishing
    steps:
      - name: generate bot token
        id: bot-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ secrets.BOT_APP_ID }}
          private-key: ${{ secrets.BOT_PRIVATE_KEY }}

      - name: checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: true
          fetch-depth: 0
          persist-credentials: true
          token: ${{ steps.bot-token.outputs.token }}

      - name: setup git user
        run: |
          git config --global user.name "bombshell-bot[bot]"
          git config --global user.email "187071675+bombshell-bot[bot]@users.noreply.github.com"

      - name: setup deno
        uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5
        with:
          # Pinned to v2.8.3 to avoid https://github.com/denoland/deno/issues/35529
          # (v2.9.0 rejects JSR files without a manifest checksum on warm cache).
          # Restore to v2.x once v2.9.1 ships.
          deno-version: v2.8.3

      - name: setup node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          registry-url: "https://registry.npmjs.org"

      - name: build wasm
        run: make

      - name: install changesets
        run: npm ci

      - name: changesets
        uses: changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2
        with:
          version-script: npm run version
          publish-script: npm run release
          commit-message: "chore: version packages"
          pr-title: "chore: version packages"
          create-github-releases: false
          push-with-git-cli: true
          github-token: ${{ steps.bot-token.outputs.token }}