From f694b14f58a6897c023dac2e68f8834bbe095bd8 Mon Sep 17 00:00:00 2001
From: Lann Martin <lmartin@akamai.com>
Date: Sun, 23 Aug 2026 09:09:38 -0400
Subject: [PATCH] jsr-publish: create the vX.Y.Z release when publishing

After a successful `deno publish`, the workflow now creates the
`vX.Y.Z` tag + GitHub release at the run's commit (title
"<repo> vX.Y.Z", body per the release-notes convention), replacing the
manual release-first step. A pre-created release is left alone; a bare
tag without a release fails loudly rather than letting
`gh release create` bind the release to the old tag's commit. Requires
contents: write.
---
 .github/workflows/jsr-publish.yml | 34 +++++++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/jsr-publish.yml b/.github/workflows/jsr-publish.yml
index 68d0d48..53b3061 100644
--- a/.github/workflows/jsr-publish.yml
+++ b/.github/workflows/jsr-publish.yml
@@ -1,14 +1,19 @@
 # Publish @polymorph/websocket (js/polyengine) to JSR.
 #
 # Auth is GitHub Actions OIDC: the package's GitHub-repository link on
-# jsr.io authorizes runs from this repository — no tokens. Dispatch
-# after a release whose manifest version is not yet on JSR; JSR rejects
-# duplicate versions, so a re-run is a no-op-by-failure.
+# jsr.io authorizes runs from this repository — no tokens. Dispatch when
+# the manifest version is not yet on JSR: the workflow publishes, then
+# creates the vX.Y.Z tag + release at this run's commit if one doesn't
+# already exist (a pre-created release is left alone; a bare tag without
+# a release fails loudly). JSR rejects duplicate versions, so a re-run
+# is a no-op-by-failure; if publish succeeded but release creation
+# failed, create the release manually at this run's commit before
+# re-dispatching.
 name: jsr-publish
 on:
   workflow_dispatch:
 permissions:
-  contents: read
+  contents: write
   id-token: write
 jobs:
   publish:
@@ -21,3 +26,24 @@ jobs:
           deno-version: "2.9.5"
       - run: deno publish
         working-directory: js/polyengine
+      - name: Create the vX.Y.Z release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          version="$(jq -r .version js/polyengine/deno.json)"
+          tag="v${version}"
+          if gh release view "$tag" -R "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            echo "release $tag already exists — nothing to create"
+            exit 0
+          fi
+          if git ls-remote --exit-code --tags origin "refs/tags/$tag" >/dev/null 2>&1; then
+            echo "tag $tag exists without a release — reconcile manually: gh release create on an existing tag would bind the release to that tag's old commit, not $GITHUB_SHA" >&2
+            exit 1
+          fi
+          notes="$RUNNER_TEMP/release-notes.md"
+          printf '%s\n\n%s\n\n%s\n' \
+            "Release \`${version}\` at ${GITHUB_SHA}." \
+            "Published to JSR: https://jsr.io/@polymorph/websocket@${version} — release created by jsr-publish; expand the notes with \`gh release edit ${tag}\` as needed." \
+            "Still 0.x/unstable, but caret-honest: releases within a minor line stay compatible; breaking changes bump the minor." \
+            >"$notes"
+          gh release create "$tag" -R "$GITHUB_REPOSITORY" --target "$GITHUB_SHA" --title "${GITHUB_REPOSITORY#*/} $tag" --notes-file "$notes"