release.yml

name: 'Release'

on:
  push:
    branches:
      - 'main'
      - 'release/**/*'

defaults:
  run:
    shell: 'bash'

jobs:
  release:
    uses: 'google-github-actions/.github/.github/workflows/release.yml@v3' # ratchet:exclude
    permissions:
      attestations: 'write'
      contents: 'write'
      packages: 'write'
    secrets:
      ACTIONS_BOT_TOKEN: '${{ secrets.ACTIONS_BOT_TOKEN }}'

  publish:
    needs:
      - 'release'
    permissions:
      contents: 'read'
      id-token: 'write'
    runs-on: 'ubuntu-latest'
    steps:
      - uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # ratchet:actions/checkout@v4

      - uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
        with:
          node-version-file: 'package.json'
          registry-url: 'https://wombat-dressing-room.appspot.com/'

      - env:
          NODE_AUTH_TOKEN: '${{ secrets.NODE_AUTH_TOKEN }}'
        run: |-
          npm publish --provenance --access public