publish.yml

name: Publish package

on:
  workflow_dispatch:

permissions: {}

jobs:
  publish-npm:
    name: Publish release to npm (OIDC)
    runs-on: ubuntu-latest
    permissions:
      # Needed to create the GitHub release and its package-version tag.
      contents: write
      # Needed by npm trusted publishing to mint an OIDC token.
      id-token: write
    steps:
      - name: Checkout repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Setup environment (node + install)
        uses: ./.github/actions/node-setup
        with:
          node-version: 24

      - name: Read package metadata
        id: package
        shell: bash
        run: |
          set -euo pipefail
          name="$(node -p "JSON.parse(require('node:fs').readFileSync('package.json', 'utf8')).name")"
          version="$(node -p "JSON.parse(require('node:fs').readFileSync('package.json', 'utf8')).version")"

          if [[ -z "${name}" || -z "${version}" ]]; then
            echo "package.json must define both name and version." >&2
            exit 1
          fi

          echo "name=${name}" >> "${GITHUB_OUTPUT}"
          echo "version=${version}" >> "${GITHUB_OUTPUT}"
          echo "tag_name=${version}" >> "${GITHUB_OUTPUT}"

      - name: Ensure workflow is running on the default branch
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        shell: bash
        run: |
          set -euo pipefail

          if [[ "${GITHUB_REF_TYPE}" != "branch" || "${GITHUB_REF_NAME}" != "${DEFAULT_BRANCH}" ]]; then
            echo "Releases must be published from ${DEFAULT_BRANCH}; this run is using ${GITHUB_REF_NAME}." >&2
            exit 1
          fi

      - name: Ensure package version is releasable
        env:
          GH_TOKEN: ${{ github.token }}
          PACKAGE_NAME: ${{ steps.package.outputs.name }}
          VERSION: ${{ steps.package.outputs.version }}
          TAG_NAME: ${{ steps.package.outputs.tag_name }}
        shell: bash
        run: |
          set -euo pipefail

          if git ls-remote --exit-code --tags origin "refs/tags/${TAG_NAME}" >/dev/null 2>&1; then
            echo "Tag ${TAG_NAME} already exists." >&2
            exit 1
          fi

          if gh release view "${TAG_NAME}" >/dev/null 2>&1; then
            echo "Release ${TAG_NAME} already exists." >&2
            exit 1
          fi

          if npm view "${PACKAGE_NAME}@${VERSION}" version >/dev/null 2>&1; then
            echo "Package ${PACKAGE_NAME}@${VERSION} is already published to npm." >&2
            exit 1
          fi

      - name: Build and validate package
        run: npm run prepublishOnly

      - name: Configure npm for OIDC trusted publishing
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          package-manager-cache: false
          registry-url: https://registry.npmjs.org

      - name: Publish to npm
        run: npm publish --provenance --access public --tag latest

      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
          PACKAGE_NAME: ${{ steps.package.outputs.name }}
          VERSION: ${{ steps.package.outputs.version }}
          TAG_NAME: ${{ steps.package.outputs.tag_name }}
        shell: bash
        run: |
          set -euo pipefail
          gh release create "${TAG_NAME}" \
            --target "${GITHUB_SHA}" \
            --title "${TAG_NAME}" \
            --notes "Published ${PACKAGE_NAME}@${VERSION} to npm."