release-or-version-pr.yml

name: ReleaseOrVersionPR

on:
  push:
    branches:
      - main

concurrency: "${{ github.workflow }}-${{ github.ref }}"

jobs:
  release:
    name: Release and changelog
    # Security: the release job can only be executed from this repo and from the main branch (not a remote thing)
    if: ${{ github.repository == 'belgattitude/httpx' && contains('refs/heads/main',github.ref)}}
    permissions:
      contents: write  #  to create release (changesets/action)
      pull-requests: write
      id-token: write # to allow npm provenance
    runs-on: ubuntu-latest
    env:
      NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
    steps:
      - name: Checkout Repo
        uses: actions/checkout@v4
        with:
          # To run comparison we need more than the latest commit. Keep the fetch-depth relatively
          # high or set it to zero to get all commits from the git repo.
          # @link https://github.com/actions/checkout#fetch-all-history-for-all-tags-and-branches
          fetch-depth: 0

      - name: Use Node.js 20.x
        uses: actions/setup-node@v4
        with:
          node-version: 20.x

      - name: 📥 Monorepo install
        uses: ./.github/actions/yarn-nm-install

      - name: ⚙️ Nx setup - SHAs for base and head for `nx affected` commands
        id: nx-set-shas
        uses: nrwl/nx-set-shas@v4

      - name: 🦋 Create Release Pull Request or Publish to npm
        id: changesets
        uses: changesets/action@v1
        with:
          publish: yarn g:release
          setupGitUser: true
        env:
          # See https://github.com/changesets/action/issues/147
          HOME: ${{ github.workspace }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
          # The regular GITHUB_TOKEN won't allow the created "Version Packages" pr to
          # trigger the regular CI workflow. This limitation can be circumvented by
          # setting a custom PAT token from a GH account and setting it the secrets.
          GITHUB_TOKEN: ${{ secrets.BELGATTITUDE_HTTPX_TOKEN }}
          NPM_CONFIG_PROVENANCE: true