release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

permissions:
  contents: write
  id-token: write

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org
          cache: npm

      - name: Ensure npm version supports trusted publishing
        run: |
          npm install -g npm@latest
          node --version
          npm --version

      - name: Validate semantic version tag
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          TAG_NAME="${GITHUB_REF_NAME}"
          if [[ ! "$TAG_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$ ]]; then
            echo "Tag $TAG_NAME is not a valid semantic version tag (expected vMAJOR.MINOR.PATCH)."
            exit 1
          fi

      - name: Validate tag matches package version
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          PACKAGE_VERSION="$(node -p "require('./package.json').version")"
          if [[ "$TAG_VERSION" != "$PACKAGE_VERSION" ]]; then
            echo "Tag version ($TAG_VERSION) does not match package.json version ($PACKAGE_VERSION)."
            exit 1
          fi

      - run: npm ci
      - run: npm test

      - name: Select npm publish strategy
        id: npm-auth
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          if [ -n "${{ secrets.NPM_TOKEN }}" ]; then
            echo "mode=token" >> "$GITHUB_OUTPUT"
            echo "Using NPM_TOKEN secret."
          elif [ "${{ vars.NPM_TRUSTED_PUBLISHING }}" = "true" ]; then
            echo "mode=oidc" >> "$GITHUB_OUTPUT"
            echo "Using npm trusted publishing (OIDC)."
          else
            echo "mode=skip" >> "$GITHUB_OUTPUT"
            echo "Skipping npm publish: set NPM_TOKEN secret or NPM_TRUSTED_PUBLISHING=true repo variable."
          fi

      - name: Publish to npm
        if: startsWith(github.ref, 'refs/tags/') && steps.npm-auth.outputs.mode == 'token'
        run: npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Publish to npm (Trusted Publishing)
        if: startsWith(github.ref, 'refs/tags/') && steps.npm-auth.outputs.mode == 'oidc'
        run: |
          # Ensure npm uses OIDC trusted publishing flow rather than token auth.
          unset NODE_AUTH_TOKEN
          cat > "$RUNNER_TEMP/npmrc-no-auth" <<'EOF'
          registry=https://registry.npmjs.org/
          EOF
          export NPM_CONFIG_USERCONFIG="$RUNNER_TEMP/npmrc-no-auth"
          npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ""

      - name: npm publish skipped
        if: startsWith(github.ref, 'refs/tags/') && steps.npm-auth.outputs.mode == 'skip'
        run: echo "npm publish skipped."

      - name: Create GitHub Release
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true