build: move dist/ bundling to release time

.github/CONTRIBUTING.md

@@ -90,44 +90,20 @@ to have these tools fix the code formatting for you.
 
 GitHub Actions does not have an automated system for building and releasing actions written in TypeScript.[^1]
 Technically speaking, a published GitHub action is not actually a package, but simply a git reference to a complete JavaScript execution tree with an `action.yml` file.
-As such, the process for releasing a new version of `nf-core/setup-nextflow` is as follows:
-
-1. Clone the `nf-core/setup-nextflow` repository locally - releases cannot be made from a fork
-2. Bump the version number within `CHANGELOG.md`, `package.json`, and `package-lock.json`
-3. Commit those changes to a branch of the name `release/vX.Y.Z`
-4. Push that branch to GitHub (`git push -u origin release/vX.Y.Z`) and merge as a regular pull request
-5. Back in the local repo, ensure you still have the `release/vX.Y.Z` branch checked out
-6. Checkout an orphan branch of the name `build/vX.Y.Z` (`git checkout --orphan build/vX.Y.Z`). All changes will be untracked and unstaged.
-7. Run `npm ci` and `npm run all`
-8. Commit the following files/directories:
-   - dist
-   - docs
-   - subaction
-   - CHANGELOG.md
-   - LICENSE
-   - README.md
-   - action.yml
-9. Delete all untracked files
-10. Remove major and major.minor version tags for this version from the remote repository
-    ```bash
-    git push origin :vX
-    git push origin :vX.Y
-    ```
-11. Tag the current commit with the major, major.minor, and major.minor.patch semantic versions. If git prompts you for a tag message, use the full major.minor.patch version string.
-    ```bash
-    git tag vX
-    git tag vX.Y
-    git tag vX.Y.Z
-    ```
-12. Push the tags to GitHub (`git push --tags`)
-13. (Optional) In the GitHub interface, create a [release](https://github.com/nf-core/setup-nextflow/releases) assigned to the tag with content copied from the CHANGELOG, and ensure it is published to the GitHub Marketplace
-14. Delete the release and build branch within the local repo
-    ```bash
-    git checkout master
-    git pull
-    git branch -d release/vX.Y.Z
-    git branch -D build/vX.Y.Z
-    ```
+`master` is source-only: `dist/` is not committed there. The bundle is built at release time by the [Release workflow](workflows/release.yml), which creates a release commit carrying `dist/` and points the version tags at it.
+
+The process for releasing a new version of `nf-core/setup-nextflow` is as follows:
+
+1. Bump the version number within `CHANGELOG.md`, `package.json`, and `package-lock.json` on a branch, and merge it to `master` as a regular pull request
+2. In the GitHub interface, go to **Actions → Release → Run workflow**, leave the branch set to `master`, and enter the full version string (e.g. `vX.Y.Z`)
+3. The workflow then:
+   - builds and smoke-tests `dist/` from `master` source
+   - creates a release commit containing `dist/` (this commit lives only on the tags, not on `master`)
+   - tags it with `vX.Y.Z` and force-moves the floating `vX` and `vX.Y` tags to it
+   - publishes the [GitHub release](https://github.com/nf-core/setup-nextflow/releases) with generated notes
+4. Edit the published release to copy content from the `CHANGELOG` and ensure it is published to the GitHub Marketplace
+
+Because `dist/` only exists on release tags, `@master` is not a usable action ref; consumers must pin a version tag such as `@vX`.
 
 ## Getting help
 

.github/workflows/example.yml

@@ -8,8 +8,6 @@ on:
       - "renovate/**" # branches Renovate creates
   pull_request:
   workflow_dispatch:
-  release:
-    types: [published]
 
 jobs:
   example-usage:

.github/workflows/release.yml

@@ -0,0 +1,80 @@
+name: Release
+
+# Dispatch-driven release: builds dist/ from master source, creates a
+# release commit containing dist/, then creates the version tag, moves
+# the floating major tag (v2), and publishes the GitHub Release — all
+# pointing at the commit that actually carries the bundle.
+#
+# master stays source-only. Users consume @v2 / @vX.Y.Z tags.
+# NOTE: @master is not usable as an action ref since dist/ is not
+# committed to master. README documents @v2 only.
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Release version (e.g. v2.1.0)"
+        required: true
+
+permissions:
+  contents: write
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  build-tag-release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate inputs
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          # Releases must be cut from master
+          [ "${GITHUB_REF}" = "refs/heads/master" ]
+          echo "${VERSION}" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+$'
+
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          ref: master
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: 24
+          cache: "npm"
+
+      - run: npm ci
+      - run: npm run build
+      - run: npm run package
+
+      - name: Smoke test the bundle
+        run: |
+          test -f dist/index.js
+          node --check dist/index.js
+
+      - name: Create release commit and tags
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add -f dist/
+          git commit -m "build: add dist for ${VERSION}"
+          git tag "${VERSION}"
+          MAJOR="$(echo "${VERSION}" | grep -oE '^v[0-9]+')"
+          MINOR="$(echo "${VERSION}" | grep -oE '^v[0-9]+\.[0-9]+')"
+          git tag -f "${MAJOR}"
+          git tag -f "${MINOR}"
+          git push origin "refs/tags/${VERSION}"
+          git push -f origin "refs/tags/${MAJOR}" "refs/tags/${MINOR}"
+
+      - name: Publish GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ inputs.version }}
+        run: |
+          gh release create "${VERSION}" \
+            --target "$(git rev-parse HEAD)" \
+            --title "${VERSION}" \
+            --generate-notes

.github/workflows/test.yml

@@ -8,8 +8,6 @@ on:
       - "renovate/**" # branches Renovate creates
   pull_request:
   workflow_dispatch:
-  release:
-    types: [published]
 
 jobs:
   test:
@@ -25,9 +23,6 @@ jobs:
       - run: npm run format:check
       - run: npm run lint
       - run: npm run package
-      - name: Check dist is up to date
-        run: |
-          git diff --exit-code dist/
       - run: npm run test
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -135,3 +135,6 @@ lib/**/*
 # Testing garbage
 .tmp
 nxf-v*
+
+# Built action bundle (generated at release time by release.yml)
+dist/