name: "Release"

on:
  push:
    branches: [main]

permissions:
  id-token: "write" # OIDC
  contents: "read"

jobs:
  release:
    runs-on: "ubuntu-latest"
    permissions:
      contents: "write"
      issues: "write"
      pull-requests: "write"
      id-token: "write"
    steps:
      - uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1" # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: "Setup Node.js"
        uses: "actions/setup-node@820762786026740c76f36085b0efc47a31fe5020" # v7.0.0
        with:
          node-version: "lts/*"
          cache: "npm"

      - name: "Install dependencies"
        run: "npm clean-install"

      - name: "Verify the integrity of provenance attestations and registry signatures for installed dependencies"
        run: "npm audit signatures"

      - name: "Release"
        run: "node --run release"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}