release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      project:
        description: Package to release
        type: choice
        options: [angular, zone-js]
        default: angular
      version:
        description: Version specifier (e.g. 22.0.0, 22.0.0-rc.4, patch, minor)
        required: true
      dry-run:
        description: Dry run (preview only, no push/publish)
        type: boolean
        default: true

concurrency:
  group: nx-release-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: write # push release commit + tag, create GitHub release
  id-token: write # npm provenance / trusted publishing (OIDC)

env:
  NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}

jobs:
  release:
    runs-on: ubuntu-latest
    environment:
      name: ${{ inputs.dry-run && 'npm-publish-dry-run' || 'npm-publish' }}
    steps:
      - uses: actions/checkout@v6
        with:
          # nx release needs tags + full history to build the changelog
          fetch-depth: 0
      - uses: actions/setup-node@v6
        with:
          node-version: lts/*
          cache: npm
          registry-url: https://registry.npmjs.org
      - name: Update npm (required for OIDC trusted publishing)
        run: |
          npm install -g npm@^11.5.1
          npm --version
      - run: npm install --force
      - name: Configure git author
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
      # Publishing is intentionally split out (--skip-publish) so the OIDC
      # token-clearing logic below wraps only the publish step.
      - name: nx release version + changelog
        run: >
          npx nx release ${{ inputs.version }}
          --groups=${{ inputs.project }}
          --skip-publish
          ${{ inputs.dry-run && '--dry-run' || '' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      # Prereleases (e.g. 22.0.0-rc.4) publish to their prerelease dist-tag (rc),
      # never latest. In a dry run keyword specifiers (patch/minor) resolve from
      # the unbumped manifest, so the previewed tag may differ from a real run.
      - name: Resolve npm dist-tag
        id: dist-tag
        shell: bash
        run: |
          set -euo pipefail
          spec='${{ inputs.version }}'
          if [[ "$spec" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-.+)?$ ]]; then
            version="$spec"
          else
            version=$(node -p "require('./packages/${{ inputs.project }}/package.json').version")
          fi
          if [[ "$version" == *-* ]]; then
            pre="${version#*-}"
            tag="${pre%%.*}"
            if [[ "$tag" =~ ^[0-9]+$ ]]; then
              tag="next"
            fi
          else
            tag="latest"
          fi
          echo "Resolved version ${version} -> dist-tag ${tag}"
          echo "tag=${tag}" >> "$GITHUB_OUTPUT"
      # OIDC trusted publishing (default): npm must find no token auth at all,
      # otherwise it uses the token instead of the OIDC exchange.
      - name: nx release publish (OIDC)
        if: ${{ vars.USE_NPM_TOKEN != 'true' }}
        shell: bash
        env:
          NPM_CONFIG_PROVENANCE: true
          NODE_AUTH_TOKEN: ""
        run: |
          set -euo pipefail
          unset NODE_AUTH_TOKEN
          rm -f ~/.npmrc || true
          if [[ -n "${NPM_CONFIG_USERCONFIG:-}" ]]; then
            rm -f "$NPM_CONFIG_USERCONFIG" || true
          fi

          npx nx release publish \
            --groups=${{ inputs.project }} \
            --tag "${{ steps.dist-tag.outputs.tag }}" \
            --access public \
            ${{ inputs.dry-run && '--dry-run' || '' }}
      # Token fallback: only when explicitly enabled via repo variable USE_NPM_TOKEN=true.
      - name: nx release publish (token)
        if: ${{ vars.USE_NPM_TOKEN == 'true' }}
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_CONFIG_PROVENANCE: true
        run: >
          npx nx release publish
          --groups=${{ inputs.project }}
          --tag "${{ steps.dist-tag.outputs.tag }}"
          --access public
          ${{ inputs.dry-run && '--dry-run' || '' }}