publish.yml

name: Publish

on:
  workflow_run:
    workflows:
      - Testing
    types:
      - completed

permissions:
  contents: read
  id-token: write

jobs:
  publish:
    name: Publish
    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'main' }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout triggering commit
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.workflow_run.head_sha }}

      - name: Setup Node.js (OIDC)
        uses: actions/setup-node@v4
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install
        run: bun install --frozen-lockfile

      - name: Check if already published
        id: check
        run: |
          PKG_NAME=$(jq -r '.name' package.json)
          PKG_VERSION=$(jq -r '.version' package.json)
          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://registry.npmjs.org/${PKG_NAME}/${PKG_VERSION}")
          if [ "$STATUS" = "200" ]; then
            echo "skip=true" >> "$GITHUB_OUTPUT"
            echo "✓ ${PKG_NAME}@${PKG_VERSION} already published"
          else
            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Publish
        if: steps.check.outputs.skip != 'true'
        run: |
          set -euo pipefail
          PKG_VERSION=$(jq -r '.version' package.json)
          NPM_TAG="latest"
          case "$PKG_VERSION" in
            *-*) NPM_TAG="beta" ;;
          esac
          npm publish --provenance --access public --loglevel verbose --tag "$NPM_TAG" || {
            echo "npm publish failed; dumping npm debug logs";
            ls -la "$HOME/.npm/_logs" || true;
            tail -n +1 "$HOME/.npm/_logs"/*-debug-0.log || true;
            exit 1;
          }