publish-internal.yml

name: Publish internal prereleases

# Publishes @repowise-dev/types and @repowise-dev/ui to GitHub Packages on
# every push to `main`, tagged as `0.0.0-internal.<short-sha>`. Downstream
# consumers (e.g. hosted-frontend) pin to a specific SHA.
#
# Source package.json files declare the published names directly
# (`@repowise-dev/types`, `@repowise-dev/ui`) but keep `private: true` and
# `version: 0.0.1`. This workflow stamps the prerelease version and
# removes `private` only at publish time. The PyPI publish workflow
# (`publish.yml`) only fires on `v*` tags and is unaffected.
#
# Triggers:
#   - push to `main` (auto), so a merged PR publishes itself
#   - workflow_dispatch (manual, for re-publishes)
#
# Publishing is idempotent. The version is derived from the commit SHA, so
# republishing one is by definition a no-op, and each step skips when the
# version is already on the registry. Without that, anything that delivers a
# second push event for a SHA already published (a duplicate webhook, a re-run,
# a manual dispatch on an already-built commit) turns main red on a 409 with
# nothing actually wrong. `cancel-in-progress` is deliberately not the fix: it
# would kill a real publish mid-flight when the next merge lands.

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read
  packages: write

concurrency:
  group: publish-internal-${{ github.ref }}
  cancel-in-progress: false

jobs:
  publish:
    name: Publish to GitHub Packages
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: "npm"
          cache-dependency-path: package-lock.json
          registry-url: "https://npm.pkg.github.com"
          scope: "@repowise-dev"

      - name: Install dependencies
        run: npm ci

      - name: Type-check + test
        run: |
          npm run type-check --workspace @repowise-dev/types
          npm run type-check --workspace @repowise-dev/ui
          npm run test --workspace @repowise-dev/types
          npm run test --workspace @repowise-dev/ui

      - name: Compute prerelease version
        id: ver
        run: |
          SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
          echo "version=0.0.0-internal.${SHORT_SHA}" >> "$GITHUB_OUTPUT"

      - name: Publish @repowise-dev/types
        working-directory: packages/types
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN_GITHUB_PACKAGES }}
          VERSION: ${{ steps.ver.outputs.version }}
        run: |
          npm pkg set version="$VERSION"
          npm pkg delete private
          if npm view "@repowise-dev/types@$VERSION" version >/dev/null 2>&1; then
            echo "@repowise-dev/types@$VERSION is already published, skipping"
          else
            npm publish
          fi

      - name: Publish @repowise-dev/ui
        working-directory: packages/ui
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN_GITHUB_PACKAGES }}
          VERSION: ${{ steps.ver.outputs.version }}
        run: |
          npm pkg set version="$VERSION"
          npm pkg set dependencies.@repowise-dev/types="$VERSION"
          npm pkg delete private
          if npm view "@repowise-dev/ui@$VERSION" version >/dev/null 2>&1; then
            echo "@repowise-dev/ui@$VERSION is already published, skipping"
          else
            npm publish
          fi

      - name: Summary
        run: |
          {
            echo "### Available on GitHub Packages"
            echo ""
            echo "- \`@repowise-dev/types@${{ steps.ver.outputs.version }}\`"
            echo "- \`@repowise-dev/ui@${{ steps.ver.outputs.version }}\`"
            echo ""
            echo "Consumer install (hosted-frontend):"
            echo ""
            echo '```json'
            echo '"@repowise-dev/types": "${{ steps.ver.outputs.version }}",'
            echo '"@repowise-dev/ui":    "${{ steps.ver.outputs.version }}"'
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"