release.yml

name: v4.x releases

on:
  push:
    branches:
    # Pushes to the branch below will test the release workflow without
    # publishing version on npm or generating new git tags
    - v4.x-test
    tags:
    - 'v4.[0-9]+.[0-9]+'
    - 'v4.[0-9]+.[0-9]+-alpha.[0-9]+'
    - 'v4.[0-9]+.[0-9]+-beta.[0-9]+'

jobs:
  install:
    name: Install
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Cache node_modules
      id: cacheModules
      uses: actions/cache@v4
      with:
        path: ~/.npm # cache where "npm install" uses before going out to the network
        key: ${{ runner.os }}-node-${{ hashFiles('**/package.json') }}
    - name: Install dependencies
      if: steps.cacheModules.outputs.cache-hit != 'true'
      run: npm install

  debug:
    name: Debug
    runs-on: ubuntu-latest
    steps:
    - uses: hmarr/debug-action@v3

  checks:
    name: Check
    needs: [install]
    uses: ./.github/workflows/checks.yml
    with:
      ref: ${{ github.sha }}

  # The security job can't run on pull requests opened from forks because
  # Github doesn't pass down the SNYK_TOKEN environment variable.
  security:
    name: Check Security
    needs: [install]
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: actions/cache@v4
      with:
        path: ~/.npm # cache where "npm install" uses before going out to the network
        key: ${{ runner.os }}-node-${{ hashFiles('**/package.json') }}
    - run: npm install --prefer-offline
    - run: make secure
      env:
        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

  publish:
    name: Publish to NPM registry
    runs-on: ubuntu-latest
    needs: [checks, security]
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-node@v4
      with:
        node-version-file: '.nvmrc'
        # Setup .npmrc file to publish to npm
        registry-url: 'https://registry.npmjs.org'
    - uses: actions/cache@v4
      with:
        path: ~/.npm # this is cache where npm installs from before going out to the network
        key: ${{ runner.os }}-node-${{ hashFiles('**/package.json') }}
    - run: npm install --prefer-offline
    - run: make publish
      env:
        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}