MCP Template

name: Semantic Release

on:
  push:
    branches:
      - main

permissions:
  contents: write
  packages: write
  id-token: write
  attestations: write
  issues: write
  pull-requests: write

jobs:
  release:
    runs-on: ubuntu-latest
    if: "!contains(github.event.head_commit.message, '[skip ci]')"
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          registry-url: 'https://registry.npmjs.org'

      - name: Enable Corepack
        run: corepack enable

      - name: Install dependencies
        run: yarn install --immutable

      - name: Run tests
        run: yarn test

      - name: Build
        run: yarn build

      - name: Run semantic-release
        id: semantic-release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_TOKEN: ''
          NODE_AUTH_TOKEN: ''
        run: |
          # Capture the current version before release
          CURRENT_VERSION=$(node -p "require('./package.json').version")
          
          # Run semantic-release
          npx semantic-release
          
          # Check if version changed (indicating a release was made)
          NEW_VERSION=$(node -p "require('./package.json').version")
          if [ "$CURRENT_VERSION" != "$NEW_VERSION" ]; then
            echo "new-release-published=true" >> $GITHUB_OUTPUT
            echo "new-version=$NEW_VERSION" >> $GITHUB_OUTPUT
          else
            echo "new-release-published=false" >> $GITHUB_OUTPUT
          fi

      - name: Generate SBOM
        if: steps.semantic-release.outputs.new-release-published == 'true'
        uses: anchore/sbom-action@v0
        with:
          format: spdx-json
          output-file: sbom.spdx.json

      - name: Attest Build Provenance
        if: steps.semantic-release.outputs.new-release-published == 'true'
        uses: actions/attest-build-provenance@v1
        with:
          subject-path: |
            ./dist
            ./sbom.spdx.json

      - name: Attest SBOM
        if: steps.semantic-release.outputs.new-release-published == 'true'
        uses: actions/attest-sbom@v1
        with:
          subject-path: './dist'
          sbom-path: './sbom.spdx.json'

      - name: Setup Node.js for GitHub Packages
        if: steps.semantic-release.outputs.new-release-published == 'true'
        uses: actions/setup-node@v4
        with:
          registry-url: 'https://npm.pkg.github.com'
          scope: '@${{ github.repository_owner }}'

      - name: Publish to GitHub Packages
        if: steps.semantic-release.outputs.new-release-published == 'true'
        run: |
          # Update package name for GitHub Packages (must be lowercase)
          npm pkg set name="@mearman/mcp-template"
          # Ensure we're publishing to GitHub Packages registry
          npm config set registry https://npm.pkg.github.com/
          # Skip prepublishOnly script to avoid running tests with modified package name
          npm publish --access public --provenance --ignore-scripts
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}