publish.yml

name: Publish Package

on:
  push:
    tags: ['v*']

permissions:
  id-token: write
  contents: read

concurrency:
  group: publish-${{ github.ref }}
  cancel-in-progress: false

jobs:
  publish:
    name: Publish to npm
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Enforce tag on main
        run: |
          git fetch origin main
          git merge-base --is-ancestor ${{ github.sha }} origin/main || {
            echo "::error::Version tags (v*) must point to a commit on main. This tag was created from another branch."
            exit 1
          }

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          registry-url: 'https://registry.npmjs.org'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Typecheck, lint, test, and build
        run: npm run ci
        env:
          CI: true

      - name: Publish to npm
        run: npm publish