publish-npm.yml

name: Publish npm package

on:
  release:
    types:
      - published
  workflow_dispatch:
    inputs:
      release_tag:
        description: "Tag to publish (must match package.json version, e.g. v0.0.1)"
        required: false
        type: string

jobs:
  publish:
    if: github.event_name == 'workflow_dispatch' || github.event.release.prerelease == false
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Ensure tag matches package version
        run: |
          EVENT_NAME="${{ github.event_name }}"
          VERSION="$(node -p "JSON.parse(require('node:fs').readFileSync('package.json', 'utf8')).version")"

          if [ "$EVENT_NAME" = "release" ]; then
            RAW_TAG="${GITHUB_REF_NAME}"
          else
            RAW_TAG="${{ github.event.inputs.release_tag }}"
            if [ -z "$RAW_TAG" ]; then
              RAW_TAG="v$VERSION"
            fi
          fi

          TAG="${RAW_TAG#v}"

          if [ "$TAG" != "$VERSION" ]; then
            echo "Release tag must be v$VERSION, got ${RAW_TAG}."
            exit 1
          fi

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          registry-url: https://registry.npmjs.org

      - name: Verify publish contents
        run: npm pack --dry-run

      - name: Publish to npm
        run: npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}