add release workflow

.github/workflows/ci.yml

@@ -0,0 +1,85 @@
+name: CI
+
+# Pull requests run this directly; pushes to main reach it through release.yml,
+# which calls this workflow before it tags and publishes.
+on:
+  pull_request:
+  workflow_call:
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  parser:
+    name: Corpus and generated files
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - name: Corpus tests
+        run: npm run parser-test
+      - name: src/ matches grammar.js
+        run: |
+          npm run parser-generate
+          if ! git diff --exit-code --stat src/; then
+            echo "::error::src/ is out of date: run 'npm run parser-generate' and commit the result"
+            exit 1
+          fi
+
+  node:
+    name: Node binding (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 22
+          cache: npm
+      # npm ci builds the addon through the install script (node-gyp-build)
+      - run: npm ci
+      - run: npm run binding-test
+
+  rust:
+    name: Rust binding
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - run: cargo test
+
+  python:
+    name: Python binding
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: python -m pip install --upgrade pip
+      - run: python -m pip install . "tree-sitter~=0.24"
+      - run: python -m unittest discover -s bindings/python/tests -v
+
+  go:
+    name: Go binding
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-go@v5
+        with:
+          go-version: stable
+      - run: go test ./bindings/go/
+
+  swift:
+    name: Swift binding
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v5
+      - run: swift build

.github/workflows/release.yml

@@ -0,0 +1,167 @@
+name: Release
+
+# Releasing is a version bump: push a commit to main that changes the version in
+# package.json, and this tags v<version>, creates the GitHub release and
+# publishes to npm. Every other push to main only runs the tests.
+#
+# Running it by hand instead publishes whatever version package.json holds, as
+# long as npm does not have it yet, and skips the tag and the release if a
+# previous attempt already made them. That is how a half-finished release is
+# retried.
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  version:
+    name: Version
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.check.outputs.version }}
+      changed: ${{ steps.check.outputs.changed }}
+      tag_exists: ${{ steps.check.outputs.tag_exists }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 2
+          fetch-tags: true
+      - id: check
+        shell: bash
+        env:
+          GITHUB_EVENT_NAME: ${{ github.event_name }}
+        run: |
+          set -euo pipefail
+          name="$(node -p "require('./package.json').name")"
+          version="$(node -p "require('./package.json').version")"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+          if git rev-parse -q --verify "refs/tags/v$version" >/dev/null; then
+            tag_exists=true
+          else
+            tag_exists=false
+          fi
+          echo "tag_exists=$tag_exists" >> "$GITHUB_OUTPUT"
+
+          if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ]; then
+            # by hand: publish what package.json says, unless npm has it already
+            if npm view "$name@$version" version >/dev/null 2>&1; then
+              echo "::warning::$name@$version is already on npm; nothing to publish"
+              echo "changed=false" >> "$GITHUB_OUTPUT"
+            else
+              echo "publishing $name@$version by hand (tag exists: $tag_exists)"
+              echo "changed=true" >> "$GITHUB_OUTPUT"
+            fi
+            exit 0
+          fi
+
+          if git cat-file -e HEAD~1:package.json 2>/dev/null; then
+            previous="$(git show HEAD~1:package.json | node -p "JSON.parse(require('node:fs').readFileSync(0, 'utf8')).version")"
+          else
+            previous=""
+          fi
+          if [ "$version" = "$previous" ]; then
+            echo "version is unchanged at $version; not releasing"
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          elif [ "$tag_exists" = "true" ]; then
+            echo "::warning::tag v$version already exists; not releasing"
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "releasing $previous -> $version"
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+  ci:
+    name: CI
+    needs: version
+    uses: ./.github/workflows/ci.yml
+
+  prebuild:
+    name: Prebuild (${{ matrix.os }})
+    needs: [version, ci]
+    if: needs.version.outputs.changed == 'true'
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: true
+      matrix:
+        # one runner per platform and architecture npm should ship a binary for;
+        # the arm Linux runner is free for public repositories only
+        os:
+          [
+            ubuntu-latest,
+            ubuntu-24.04-arm,
+            macos-13,
+            macos-latest,
+            windows-latest,
+          ]
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run prebuildify
+      - uses: actions/upload-artifact@v4
+        with:
+          name: prebuilds-${{ matrix.os }}
+          path: prebuilds/
+          if-no-files-found: error
+
+  publish:
+    name: Tag and publish
+    needs: [version, prebuild]
+    if: needs.version.outputs.changed == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # the tag and the release
+      id-token: write # provenance for npm
+    env:
+      VERSION: ${{ needs.version.outputs.version }}
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 22
+          cache: npm
+          registry-url: https://registry.npmjs.org
+      - name: Collect the prebuilds
+        uses: actions/download-artifact@v4
+        with:
+          pattern: prebuilds-*
+          path: prebuilds/
+          merge-multiple: true
+      - run: ls -R prebuilds/
+      - run: npm ci
+      # tree-sitter build --wasm needs Emscripten; the CLI runs it through
+      # Docker, which the ubuntu runners have
+      - name: Build the Wasm parser
+        run: npm run parser-build
+      # a retry of a half-finished release finds its tag and release already made
+      - name: Tag
+        if: needs.version.outputs.tag_exists != 'true'
+        run: |
+          set -euo pipefail
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git tag -a "v$VERSION" -m "v$VERSION"
+          git push origin "v$VERSION"
+      - name: Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          if gh release view "v$VERSION" >/dev/null 2>&1; then
+            echo "release v$VERSION exists; replacing its Wasm build"
+            gh release upload "v$VERSION" tree-sitter-django.wasm --clobber
+          else
+            gh release create "v$VERSION" --title "v$VERSION" --generate-notes tree-sitter-django.wasm
+          fi
+      - name: Publish
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish --provenance --access public

CLAUDE.md

@@ -55,6 +55,37 @@ Every binding was built and run on macOS: `npm install` plus `npm run binding-te
 `||` (`-Wlogical-op-parentheses`), so a comparison chain written with both needs its `&&` groups
 parenthesized.
 
+### CI and releasing
+
+`.github/workflows/ci.yml` runs on pull requests, and the release workflow calls it: the corpus tests, a
+check that `npm run parser-generate` leaves `src/` unchanged, the Node binding on Linux, macOS and Windows,
+and the Rust, Python, Go and Swift bindings.
+
+`.github/workflows/release.yml` runs on every push to `main` but only releases when `package.json`'s version
+differs from the previous commit's and no `v<version>` tag exists yet. Then it runs CI, `prebuildify` on
+five runners (Linux x64 and arm64, macOS x64 and arm64, Windows x64), and a last job that tags `v<version>`,
+creates the GitHub release with `tree-sitter-django.wasm` attached, and runs `npm publish --provenance`.
+**A release is a version-bump commit on `main`**; no other push starts one.
+
+Running the workflow by hand (`workflow_dispatch`) is the retry: it publishes whatever version
+`package.json` holds as long as `npm view` does not find it on the registry already, and it skips the tag
+and the release when a previous attempt left them behind, replacing only the Wasm asset. So a run that
+tagged and then failed to publish is finished by running it again, and a run against an already published
+version stops at the version job.
+
+Releasing needs three things to line up:
+
+- the `NPM_TOKEN` secret, a granular automation token. Provenance also needs `id-token: write`, which the
+  publish job already declares.
+- **the version in `package.json` and in `tree-sitter.json`'s `metadata`**. The release trigger reads the
+  first; the second is compiled into `src/parser.c` as the language's version, so bumping one alone leaves
+  the parser disagreeing with the manifest.
+- `npm run parser-generate` after that bump, committed with it, or CI's up-to-date check fails on a two-line
+  diff in `src/parser.c`.
+
+The arm64 Linux runner (`ubuntu-24.04-arm`) is free for public repositories only. `tree-sitter build --wasm`
+runs Emscripten through Docker, which the ubuntu runners provide.
+
 ### Stale parser library
 
 tree-sitter caches the compiled parser in `~/.cache/tree-sitter/lib/django.*`, and it has served a stale

README.md

@@ -74,6 +74,13 @@ to `grammar.js` or `src/scanner.c` is only half made until `parser-generate` has
 committed alongside it. `tree-sitter test` compiles the parser itself, so a stale `src/` shows up as tests
 that pass against the wrong grammar.
 
+Pull requests run the corpus tests and every binding through `.github/workflows/ci.yml`. A release is a
+version-bump commit on `main`: raise the version in `package.json` and in `tree-sitter.json`'s `metadata`,
+run `npm run parser-generate`, and push. The workflow tags `v<version>`, publishes to npm with provenance
+and prebuilt binaries for Linux, macOS and Windows, and attaches `tree-sitter-django.wasm` to the GitHub
+release. Running the workflow by hand publishes the current version if npm does not have it yet,
+which is how a release that failed part way through is retried.
+
 ## Queries
 
 Five of the files in `queries/` are query files an editor loads: