release.yml

name: Release

on:
  release:
    types: [published]

permissions:
  contents: read
  id-token: write

jobs:
  publish:
    runs-on: ubuntu-latest
    env:
      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
    steps:
      - name: Checkout release tag
        uses: actions/checkout@v5
        with:
          ref: ${{ github.event.release.tag_name }}

      - name: Setup Node
        uses: actions/setup-node@v5
        with:
          node-version: 20
          registry-url: https://registry.npmjs.org

      - name: Install dependencies
        run: npm ci

      - name: Verify tag matches package.json version
        run: |
          tag="${GITHUB_REF_NAME#v}"
          pkg=$(node -p "require('./package.json').version")
          if [ "$tag" != "$pkg" ]; then
            echo "::error::Tag ${GITHUB_REF_NAME} (=$tag) does not match package.json version $pkg"
            exit 1
          fi
          echo "Tag and package.json both at $pkg"

      - name: Run tests
        run: npm test

      - name: Verify skills contract
        run: npm run verify:skills

      - name: Packs lock check (parity with PR CI)
        run: npm run packs:check

      - name: Packs vendor-sync check (parity with PR CI)
        run: npm run packs:vendor:sync -- --check

      - name: Mechanical score (banned openers, key-free)
        run: npm run score:mechanical

      # Prerelease (e.g. 5.0.0-rc.1) → npm dist-tag `rc` so `latest` stays on stable.
      # Stable → default `latest` tag.
      - name: Publish to npm
        run: |
          pkg=$(node -p "require('./package.json').version")
          if node -e "process.exit(/-(rc|alpha|beta|pre)/i.test(process.argv[1])?0:1)" "$pkg"; then
            echo "Publishing prerelease $pkg with dist-tag rc"
            npm publish --access public --provenance --tag rc
          else
            echo "Publishing stable $pkg with dist-tag latest"
            npm publish --access public --provenance
          fi
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}