publish-trusted.yml

name: Publish Package (Trusted Publishing)

on:
  push:
    tags:
      - 'v*'

permissions:
  id-token: write # Required for OIDC trusted publishing
  contents: read

jobs:
  publish:
    name: Publish to npm with Trusted Publishing
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Setup environment
        uses: ./.github/actions/setup
        with:
          node-version: '22.x'

      # Ensure npm 11.5.1 or later is installed for trusted publishing support
      - name: Update npm to latest version
        run: npm install -g npm@latest

      - name: Build package
        run: pnpm run build
        env:
          WAHA_URL: 'skip' # Skip fetching during publish, use committed types

      - name: Verify build artifacts
        run: |
          if [ ! -f "dist/index.esm.js" ]; then
            echo "ERROR: Build artifacts missing - dist/index.esm.js not found"
            exit 1
          fi
          echo "✓ Build artifacts verified"
          ls -la dist/

      # Publish using OIDC authentication (no NPM_TOKEN needed)
      # Prereleases are published with extracted tag (e.g., v1.0.0-dev.1 → --tag dev)
      - name: Publish to npm
        run: |
          VERSION="${GITHUB_REF#refs/tags/v}"
          if [[ "$VERSION" == *"-"* ]]; then
            # Extract tag name: 1.0.0-dev.1 → dev, 1.0.0-beta.2 → beta
            PRERELEASE="${VERSION#*-}"  # dev.1 or beta.2
            TAG="${PRERELEASE%%.*}"      # dev or beta
            echo "Publishing prerelease version $VERSION with --tag $TAG"
            npm publish --access public --no-git-checks --tag "$TAG"
          else
            echo "Publishing stable version $VERSION"
            npm publish --access public --no-git-checks
          fi