release.yml

name: Release

on:
  push:
    tags: ['v*']

permissions:
  contents: read
  id-token: write

jobs:
  publish:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      # No `version:` here on purpose — pnpm/action-setup@v4 refuses to run when
      # the version is pinned both here and in package.json's packageManager,
      # which is the single source of truth.
      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm
          registry-url: https://registry.npmjs.org

      - run: pnpm install --frozen-lockfile

      - name: Verify the tag matches package.json
        run: |
          TAG="${GITHUB_REF_NAME#v}"
          PKG=$(node -p "require('./package.json').version")
          test "$TAG" = "$PKG" || { echo "Tag $TAG != package.json $PKG"; exit 1; }

      - run: node scripts/sync-version.mjs --check

      - run: pnpm typecheck
      - run: pnpm lint
      - run: pnpm test:unit
      - run: pnpm test:integration
      - run: pnpm build
      - run: pnpm test:e2e

      # A version already on npm is not a failure: the tag may have been pushed
      # after a manual publish, or re-pushed to rerun the checks. Publishing is
      # the only step here that cannot be repeated, so it is the only one that
      # needs the guard.
      - name: Check whether this version is already published
        id: published
        run: |
          NAME=$(node -p "require('./package.json').name")
          VERSION=$(node -p "require('./package.json').version")
          if npm view "$NAME@$VERSION" version >/dev/null 2>&1; then
            echo "already=true" >> "$GITHUB_OUTPUT"
            echo "$NAME@$VERSION is already on npm — skipping publish."
          else
            echo "already=false" >> "$GITHUB_OUTPUT"
            echo "$NAME@$VERSION is not on npm yet."
          fi

      - name: Publish to npm
        if: steps.published.outputs.already == 'false'
        run: |
          if [ -z "$NODE_AUTH_TOKEN" ]; then
            echo "::error::NPM_TOKEN is not configured, so this release cannot be published."
            echo "Create an Automation token at npmjs.com and add it with:"
            echo "  gh secret set NPM_TOKEN -R ${{ github.repository }}"
            exit 1
          fi
          pnpm publish --access public --no-git-checks --provenance
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}