publish.yml

name: Publish to npm

# Publishes the package to npm with an npm provenance statement.
# Provenance (a Sigstore build attestation) is required for n8n Cloud
# verification and can only be generated from a CI job with OIDC, so all
# releases must go through this workflow rather than a local `npm publish`.
#
# Trigger: push a version tag, e.g.
#   git tag v1.3.2 && git push origin v1.3.2
# The tag must match the `version` in package.json.

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

permissions:
  contents: read
  id-token: write # required for npm provenance (Sigstore OIDC)

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          registry-url: 'https://registry.npmjs.org'

      - name: Verify publish runs from a matching tag
        # Publishes only from a tag ref whose name equals v<package.json version>,
        # so every provenance-backed release is tied to a tagged commit. The
        # ref-type check is load-bearing: workflow_dispatch can run from a branch,
        # and without it a branch named like the version (e.g. v1.3.5) would pass
        # the name check and publish untagged.
        run: |
          if [ "$GITHUB_REF_TYPE" != "tag" ]; then
            echo "::error::Publish must run from a tag ref, got $GITHUB_REF_TYPE $GITHUB_REF_NAME"
            exit 1
          fi
          PKG_VERSION="v$(node -p "require('./package.json').version")"
          if [ "$PKG_VERSION" != "$GITHUB_REF_NAME" ]; then
            echo "::error::Tag $GITHUB_REF_NAME does not match package.json version $PKG_VERSION"
            exit 1
          fi

      - name: Install dependencies
        run: npm install

      - name: Build
        run: npm run build

      - name: Verify icon assets are bundled
        run: |
          test -f dist/nodes/Hedy/hedy.png || { echo "::error::dist/nodes/Hedy/hedy.png is missing — the build did not bundle the node icon"; exit 1; }

      - name: Publish to npm with provenance
        run: npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}