npm-publish.yaml

name: npm Publish

on:
  repository_dispatch:
    types: [npm-publish]

permissions:
  id-token: write
  contents: read

env:
  CI: true

jobs:
  publish:
    name: Publish to npm
    if: github.ref == 'refs/heads/main'
    environment: npm Publish
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 1

      - name: Install pnpm
        uses: pnpm/action-setup@v4

      - name: Setup node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24
          # No cache - hardened against cache poisoning for sensitive publish operations
          registry-url: "https://registry.npmjs.org"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Publish to npm
        run: pnpm ci:publish
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}