ci.yml

name: ci
on:
  push:
    branches:
      - "**"
  workflow_dispatch:
  workflow_run:
    workflows: [ "update-snapshots" ]
    types:
      - completed

defaults:
  run:
    # NOTE: A bit stricter than the default bash options used by GitHub Actions
    # (bash --noprofile --norc -e -o pipefail {0})
    shell: bash --noprofile --norc -euo pipefail {0}

# NOTE: Set concurrency for the current workflow to 1
concurrency: ci-${{ github.ref }}-${{ github.workflow }}

jobs:
  build-and-release:
    timeout-minutes: 60
    runs-on: ubuntu-24.04
    permissions:
      id-token: write  # Required for OIDC
      contents: write
      pull-requests: write
      issues: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: capralifecycle/actions-lib/check-runtime-dependencies@e171100ce03323fb228b3c03072fc7b83f93a775 # v1.10.1

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: ".node-version"
          cache: "npm"

      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        id: setup-python
        with:
          python-version-file: ".python-version"

      - name: python - setup uv
        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
        with:
          enable-cache: true

      - name: build and verify
        run: make ci

      - name: conditionally semantic release
        if: ${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: npm run semantic-release