[pull] main from primer:main

.github/workflows/release.yml

@@ -1,13 +1,21 @@
 name: Release
 on:
   push:
-    branches:
-      - 'main'
-      - 'next_major'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  id-token: write # Required for OIDC
+  contents: read
+  checks: write
+  statuses: write
+
 jobs:
-  release:
-    name: Final
-    if: ${{ github.repository == 'primer/css' }}
+  release-main:
+    name: Main
+    if: ${{ github.repository == 'primer/css' && github.ref_name == 'main' }}
 
     runs-on: ubuntu-latest
     steps:
@@ -19,9 +27,9 @@ jobs:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
         with:
-          node-version: 18.x
+          node-version: 24
           cache: 'npm'
 
       - name: Install dependencies
@@ -45,4 +53,59 @@ jobs:
           publish: npm run release
         env:
           GITHUB_TOKEN: ${{ steps.get-access-token.outputs.access-token }}
-          NPM_TOKEN: ${{ secrets.NPM_AUTH_TOKEN_SHARED }}
+
+  release-candidate:
+    name: Candidate
+    if: ${{ github.repository == 'primer/css' && github.ref_name == 'changeset-release/main' }}
+
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+        with:
+          # This makes Actions fetch all Git history so that Changesets can generate changelogs with the correct commits
+          fetch-depth: 0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Publish release candidate
+        run: |
+          version=$(jq -r .version package.json)
+          echo "$( jq ".version = \"$(echo $version)-rc.$(git rev-parse --short HEAD)\"" package.json )" > package.json
+          npm publish --tag next
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Output candidate version number
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const package = require(`${process.env.GITHUB_WORKSPACE}/package.json`)
+            github.rest.repos.createCommitStatus({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              sha: context.sha,
+              state: 'success',
+              context: `Published ${package.name}`,
+              description: package.version,
+              target_url: `https://unpkg.com/${package.name}@${package.version}/`
+            })
+
+      - name: Upload versions json file
+        uses: primer/.github/.github/actions/upload-versions@main
+
+  release-canary:
+    name: Canary
+    if: ${{ github.repository == 'primer/css' && github.ref_name != 'main' && github.ref_name != 'changeset-release/main' }}
+    uses: primer/.github/.github/workflows/release_canary.yml@v2.3.0
+    with:
+      install: npm ci
+    secrets:
+      gh_token: ${{ secrets.GITHUB_TOKEN }}