release.yml

name: Release

on:
  workflow_run:
    workflows: ['Quality Checks']
    types: [completed]
    branches: [main]

permissions:
  contents: write

jobs:
  release:
    name: Semantic Release
    runs-on: ubuntu-latest
    if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push'
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          persist-credentials: true
          token: ${{ secrets.GITHUB_TOKEN }}

      - uses: actions/setup-node@v4
        with:
          node-version: 'lts/*'

      # No Corepack step, and none is needed. `yarnPath` in .yarnrc.yml points
      # at the Yarn 4.18.0 binary committed under .yarn/releases, and every
      # yarn honours it — including the Yarn 1.22.x that GitHub runners
      # preinstall. So the `yarn` invocations below run Yarn 4 whatever the
      # runner ships, with no dependency on Corepack (which Node stopped
      # distributing as of 25.0.0) or on which Node `lts/*` resolves to.
      #
      # This is what makes `yarn install --immutable` actually immutable.
      # Previously classic Yarn serviced it, could not read a Yarn 4 lockfile,
      # and silently ignored `--immutable` (it spells it `--frozen-lockfile`) —
      # so it re-resolved every dependency from the package.json ranges and
      # rewrote yarn.lock on each release run ("success Saved lockfile" in the
      # job log). Now a drifted lockfile fails the job with YN0028 instead.

      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
        with:
          php-version: '8.4'
          tools: composer:v2
          coverage: none

      - name: Install PHP dependencies
        run: composer install --no-interaction --no-progress

      - name: Install Node dependencies
        run: yarn install --immutable

      - name: Run semantic-release
        run: yarn release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Notify Packagist of new release
        env:
          PACKAGIST_USERNAME: ${{ secrets.PACKAGIST_USERNAME }}
          PACKAGIST_API_TOKEN: ${{ secrets.PACKAGIST_API_TOKEN }}
        run: |
          if ! tag=$(git describe --tags --exact-match HEAD 2>/dev/null); then
            echo "No new tag at HEAD; skipping Packagist update."
            exit 0
          fi
          echo "Notifying Packagist of release $tag"
          curl -fsSL -X POST \
            -H 'Content-Type: application/json' \
            "https://packagist.org/api/update-package?username=${PACKAGIST_USERNAME}&apiToken=${PACKAGIST_API_TOKEN}" \
            -d "{\"repository\":{\"url\":\"https://github.com/${GITHUB_REPOSITORY}\"}}"