publish-to-npm.yml

name: Publish to npm (OIDC)

on:
  push:
    branches:
      - main
    paths:
      - 'src/**'
      - 'package.json'
      - 'pnpm-lock.yaml'
  pull_request:
    paths:
      - 'src/**'
      - 'package.json'
      - 'pnpm-lock.yaml'
  release:
    types: [published]
  workflow_dispatch:

permissions:
  id-token: write
  contents: read

env:
  publish: false

jobs:
  publish:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          registry-url: 'https://registry.npmjs.org'
          always-auth: true

      - name: Ensure latest npm
        run: npm install -g npm@latest

      - name: Install dependencies
        run: |
          npm i -g pnpm
          pnpm install

      - name: Check if package needs publishing
        id: check_publish
        run: |
          current_version=$(node -p "require('./package.json').version")
          npm_package_name=$(node -p "require('./package.json').name")
          published_version=$(npm show $npm_package_name version) || echo "0.0.0"

          echo "Current version: $current_version"
          echo "Published version: $published_version"

          if [ "$current_version" == "$published_version" ]; then
            echo "No new version. Skipping publish."
            echo "publish=false" >> $GITHUB_ENV
          else
            echo "New version available. Proceeding to publish."
            echo "publish=true" >> $GITHUB_ENV
          fi

      - name: Build the project
        run: |
          pnpm run build

      - name: Publish to npm using OIDC
        if: env.publish == 'true'
        run: |
          npm publish --provenance