release.yml

name: release

# Publishes wasmagent-protocol to PyPI via Trusted Publishing (OIDC) on version
# tags. No API token or secret is stored — PyPI verifies this workflow's OIDC
# identity against the pending/active publisher registered for the project
# (repo WasmAgent/wasmagent-protocol, workflow release.yml, no environment).
on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build:
    name: Build distributions
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.x'
      - name: Build sdist + wheel
        run: |
          python -m pip install --upgrade pip build twine
          python -m build
          twine check dist/*
      - name: Verify the built wheel is importable and schemas load
        run: |
          python -m pip install dist/*.whl
          python -c "from wasmagent_protocol import get_schema, schema_ids; assert get_schema('aep-record')['title']=='AEPRecord'; print('ids:', schema_ids())"
      - uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  pypi-publish:
    name: Publish to PyPI (Trusted Publishing)
    needs: build
    runs-on: ubuntu-latest
    # No `environment:` — the pending publisher was registered with an empty
    # environment, so this job must also run without one to match.
    permissions:
      id-token: write  # mandatory for OIDC trusted publishing
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1

  npm-publish:
    name: Publish to npm (Trusted Publishing / OIDC)
    runs-on: ubuntu-latest
    permissions:
      id-token: write  # mandatory for npm OIDC trusted publishing
      contents: read
    steps:
      - uses: actions/checkout@v4
      # Per npm's official trusted-publishing example: setup-node@v6 + Node 24
      # (npm >= 11.5.1) + registry-url. v6 wires OIDC correctly; v4 does not and
      # rejects package-manager-cache. No NODE_AUTH_TOKEN — npm performs the OIDC
      # token exchange itself when id-token: write is granted.
      - uses: actions/setup-node@v6
        with:
          node-version: '24'
          registry-url: 'https://registry.npmjs.org'
          package-manager-cache: false
      - name: Show npm version (must be >= 11.5.1 for OIDC)
        run: npm --version
      - name: Verify loader before publish
        run: node --test
      - name: Publish to npm (OIDC — no token, provenance auto-generated)
        run: npm publish --access public