ci: setup release workflow

Author: edusperoni

.github/workflows/release.yml

@@ -0,0 +1,94 @@
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      project:
+        description: Package to release
+        type: choice
+        options: [angular, zone-js]
+        default: angular
+      version:
+        description: Version specifier (e.g. 22.0.0, patch, minor)
+        required: true
+      dry-run:
+        description: Dry run (preview only, no push/publish)
+        type: boolean
+        default: true
+
+concurrency:
+  group: nx-release-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write # push release commit + tag, create GitHub release
+  id-token: write # npm provenance / trusted publishing (OIDC)
+
+env:
+  NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    environment:
+      name: ${{ inputs.dry-run && 'npm-publish-dry-run' || 'npm-publish' }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          # nx release needs tags + full history to build the changelog
+          fetch-depth: 0
+      - uses: actions/setup-node@v6
+        with:
+          node-version: lts/*
+          cache: npm
+          registry-url: https://registry.npmjs.org
+      - name: Update npm (required for OIDC trusted publishing)
+        run: |
+          npm install -g npm@^11.5.1
+          npm --version
+      - run: npm install --force
+      - name: Configure git author
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+      # Publishing is intentionally split out (--skip-publish) so the OIDC
+      # token-clearing logic below wraps only the publish step.
+      - name: nx release version + changelog
+        run: >
+          npx nx release ${{ inputs.version }}
+          --groups=${{ inputs.project }}
+          --skip-publish
+          ${{ inputs.dry-run && '--dry-run' || '' }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      # OIDC trusted publishing (default): npm must find no token auth at all,
+      # otherwise it uses the token instead of the OIDC exchange.
+      - name: nx release publish (OIDC)
+        if: ${{ vars.USE_NPM_TOKEN != 'true' }}
+        shell: bash
+        env:
+          NPM_CONFIG_PROVENANCE: true
+          NODE_AUTH_TOKEN: ""
+        run: |
+          set -euo pipefail
+          unset NODE_AUTH_TOKEN
+          rm -f ~/.npmrc || true
+          if [[ -n "${NPM_CONFIG_USERCONFIG:-}" ]]; then
+            rm -f "$NPM_CONFIG_USERCONFIG" || true
+          fi
+
+          npx nx release publish \
+            --groups=${{ inputs.project }} \
+            --access public \
+            ${{ inputs.dry-run && '--dry-run' || '' }}
+      # Token fallback: only when explicitly enabled via repo variable USE_NPM_TOKEN=true.
+      - name: nx release publish (token)
+        if: ${{ vars.USE_NPM_TOKEN == 'true' }}
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true
+        run: >
+          npx nx release publish
+          --groups=${{ inputs.project }}
+          --access public
+          ${{ inputs.dry-run && '--dry-run' || '' }}