release.yaml

name: Release

# Mirrors the photon-hq pattern (see spectrum-ts, uri): push to main,
# let buildspace's PR-label gate look back at the merge commit and
# decide whether to actually release. `secrets: inherit` passes
# org-level OPENAI_API_KEY + NPM_TOKEN through automatically.

on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      release:
        type: boolean
        description: "Force release (skip the PR-label check)"
        default: false
      dry-run:
        type: boolean
        description: "Run without publishing"
        default: false

# npm OIDC Trusted Publishing prerequisites (so future maintainers don't relearn this):
#   1. A trusted publisher must be configured on npmjs.com for @photon-ai/cli with the
#      GitHub org `photon-hq`, repo `cli`, the CALLER workflow filename `release.yaml`
#      (npm validates the caller, not buildspace's reusable workflow), no environment,
#      and "Allow npm publish" enabled.
#   2. `use-oidc: true` + `id-token: write` below.
#   3. buildspace's publish-npm action upgrades npm to >= 11.5.1 (Node 20 ships npm 10,
#      which can't authenticate tokenlessly).

jobs:
  release:
    uses: photon-hq/buildspace/.github/workflows/typescript-service-release.yaml@main
    permissions:
      contents: write
      pull-requests: read
      id-token: write
      # buildspace's typescript-service-release.yaml declares `packages: write` on its
      # (opt-in, skipped) github-packages-publish job. GitHub validates called-workflow
      # job permissions against this grant at startup — before evaluating `if:` — so
      # omitting this fails every run with startup_failure.
      packages: write
    with:
      service-name: "@photon-ai/cli"
      build-command: "bun run build"
      use-oidc: true
      release: ${{ github.event_name == 'workflow_dispatch' && inputs.release || false }}
      dry-run: ${{ github.event_name == 'workflow_dispatch' && inputs['dry-run'] || false }}
    secrets: inherit