npmpublish.yml

name: Publish to NPM

on:
  release:
    types:
      - published

permissions:
  contents: read
  id-token: write

jobs:
  publish-npm:
    environment: production
    runs-on: ubuntu-latest
    env:
      RELEASE_TAG: ${{ github.event.release.tag_name }}
      IS_PRERELEASE: ${{ github.event.release.prerelease }}
    steps:
      - name: Checkout (no repo token persisted)
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          persist-credentials: false
          ref: ${{ github.event.release.tag_name }}

      - name: Setup Node
        uses: actions/setup-node@v7
        with:
          node-version-file: '.nvmrc'
          registry-url: https://registry.npmjs.org/
          package-manager-cache: false

      - name: Assert latest npm
        # run: npm i -g npm@latest # pin to v11 until npm v12 bug is fixed: https://github.com/npm/cli/issues/9722
        run: npm i -g npm@11

      - name: Guard - block registry overrides and shady files
        run: |
          # fail if any .npmrc exists in repo
          if git ls-files -z | xargs -0 -I{} bash -lc '[[ "{}" == *.npmrc ]]' | grep -q .; then
            echo "Repo contains an .npmrc. Refusing to publish."; exit 1;
          fi
          # fail if publishConfig.registry set
          node -e "const p=require('./package.json'); if(p.publishConfig?.registry){console.error('publishConfig.registry present — refuse to publish'); process.exit(1)}"
          # optional: block workflow/script changes in the release commit
          SHA=$(git rev-list -n 1 "$RELEASE_TAG")
          PARENT=$(git rev-list -n 1 "$SHA^")
          git diff --name-only "$PARENT" "$SHA" | grep -E '^\\.github/(workflows|scripts)/' \
            && { echo 'Workflow/scripts changed in release commit — refuse.'; exit 1; } || true

      - name: Verify tag matches package version
        run: |
          PKG_VERSION=$(node -p "require('./package.json').version")
          TAG="${RELEASE_TAG#v}"
          [[ "$PKG_VERSION" == "$TAG" ]] || { echo "Tag v$TAG != package.json $PKG_VERSION"; exit 1; }

      - name: Install deps (no lifecycle scripts)
        run: npm ci --ignore-scripts

      - run: npm run clean
      - run: npm run build

      - name: Resolve dist-tag
        id: dist
        run: |
          if [ "$IS_PRERELEASE" = "true" ]; then
            echo "tag=beta" >> "$GITHUB_OUTPUT"
          else
            echo "tag=latest" >> "$GITHUB_OUTPUT"
          fi

      - name: Publish
        env:
          NPM_CONFIG_PROVENANCE: true
          DIST_TAG: ${{ steps.dist.outputs.tag }}
        run: npm publish --access public --ignore-scripts --registry=https://registry.npmjs.org/ --provenance --tag "$DIST_TAG"