release.yml

name: Release

# Publishes @getpipher/welcome to npm on tag push (v*) AND creates a GitHub
# Release (auto-generated notes). Uses the getpipher org secret NPM_TOKEN
# (granular npm token, Read-and-write, scoped to @getpipher, with
# "Bypass 2FA" — no OTP needed). Inherited by all getpipher repos.
#   gh secret set NPM_TOKEN --org getpipher
# The GitHub Release step uses the auto-provided github.token (no secret).
#
# Shape: cursor/vision/term (pnpm + node 20 + typecheck + test:run gates +
# idempotent npm publish) + armory-todo (idempotent gh release create).
# Both the publish and the release steps are idempotent — safe to re-run.

on:
  push:
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: write  # needed for `gh release create`

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: pnpm/action-setup@v6
        with:
          version: 10

      - uses: actions/setup-node@v7
        with:
          node-version: "24"
          cache: pnpm
          registry-url: https://registry.npmjs.org

      - run: pnpm install --frozen-lockfile

      - run: pnpm typecheck

      - run: pnpm test:run

      - name: Skip if already published
        id: check
        run: |
          set -u
          ver=$(node -p "require('./package.json').version")
          pkg=$(node -p "require('./package.json').name")
          existing=$(npm view "$pkg@$ver" version 2>/dev/null || true)
          if [ "$existing" = "$ver" ]; then
            echo "::notice::$pkg@$ver already on npm — skipping publish"
            echo "skip=true" >> "$GITHUB_OUTPUT"
          else
            echo "Publishing $pkg@$ver"
            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Publish
        if: steps.check.outputs.skip != 'true'
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish --access public

      - name: Create GitHub Release
        if: success()
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          tag="${GITHUB_REF_NAME}"
          if gh release view "$tag" >/dev/null 2>&1; then
            echo "::notice::Release $tag already exists — skipping"
          else
            gh release create "$tag" --generate-notes --title "$tag"
          fi