release-please.yml

name: Release PR

# Maintains an open "chore(main): release x.y.z" pull request that accumulates every
# merged change, derives the next version from the conventional-commit history, and
# rewrites CHANGELOG.md. Nothing is versioned or tagged until that PR is merged.
#
# Chosen over fully automatic publishing on purpose: releasing is irreversible on npm,
# so there is a human gate. Merging the release PR tags the commit; the actual
# `npm publish` stays in release.yml, which is manual.
on:
  push:
    branches: [main]

permissions:
  contents: write
  pull-requests: write

jobs:
  release-please:
    runs-on: ubuntu-latest
    steps:
      - uses: googleapis/release-please-action@v5
        with:
          # A PAT, not GITHUB_TOKEN. GitHub refuses to trigger workflows from events
          # raised with GITHUB_TOKEN, so the release pull request would arrive with
          # every check stuck in "action_required" and never run — and the branch
          # ruleset requires those checks, making the PR permanently unmergeable.
          # Falls back to GITHUB_TOKEN so the workflow still functions without the
          # secret; the PR just will not get checks.
          token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
          # Configuration lives in release-please-config.json and the current version
          # in .release-please-manifest.json. Without the manifest the action logs
          # 'No version for path .' and never opens a release PR — it cannot know
          # what the previous version was, since no release has ever been tagged.
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json