npm-publish.yml

# Publish the `fleischwolf` npm package (Node.js / Bun native bindings) for a
# chosen release. The package is a native N-API addon, so it can't be a one-line
# `npm publish`: it's built on a matrix of native runners (one per OS/arch),
# each producing a platform `.node`, then a publish job assembles the main
# package plus per-platform `optionalDependencies` (fleischwolf-<triple>) via
# napi-rs and publishes them all.
#
# Trigger: manual only (workflow_dispatch). Pick the release tag to build — the
# workflow checks out that tag and publishes the npm version derived from it, so
# npm releases stay decoupled from the crates.io release on every master push.
# Run it from the Actions tab (or `gh workflow run npm-publish.yml -f tag=v0.7.0`).
#
# Requires one repository secret: NPM_TOKEN — an npm automation token with
# publish rights to `fleischwolf` and the `fleischwolf-*` platform packages.

name: npm publish

on:
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag to build and publish (e.g. v0.7.0)."
        required: true
      version:
        description: "Override the npm version (e.g. 0.7.0). Blank = derive from the tag."
        required: false
        default: ""

concurrency:
  group: npm-publish-${{ inputs.tag }}
  cancel-in-progress: false

defaults:
  run:
    working-directory: crates/fleischwolf-node

jobs:
  build:
    name: build ${{ matrix.target }}
    runs-on: ${{ matrix.host }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            host: ubuntu-22.04
          # GitHub-hosted ARM64 Linux runner (native — avoids cross-compiling the
          # ONNX/ort build). Requires the arm64 runner image to be available.
          - target: aarch64-unknown-linux-gnu
            host: ubuntu-24.04-arm
          - target: x86_64-apple-darwin
            host: macos-13
          - target: aarch64-apple-darwin
            host: macos-14
          - target: x86_64-pc-windows-msvc
            host: windows-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.tag }}

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - uses: Swatinem/rust-cache@v2
        with:
          # One workspace, key the cache per target so the 5 jobs don't collide.
          key: ${{ matrix.target }}
          workspaces: "."

      - uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Install napi CLI
        run: npm install

      # Native addon + the JS loader / d.ts. `--strip` keeps the (ONNX-linked)
      # binary as small as possible; strip isn't available under MSVC, so the
      # Windows build omits it.
      - name: Build (unix)
        if: runner.os != 'Windows'
        run: npx napi build --platform --release --strip --target ${{ matrix.target }} --js native.js --dts native.d.ts

      - name: Build (windows)
        if: runner.os == 'Windows'
        run: npx napi build --platform --release --target ${{ matrix.target }} --js native.js --dts native.d.ts

      - name: Upload prebuilt binary
        uses: actions/upload-artifact@v4
        with:
          name: bindings-${{ matrix.target }}
          path: crates/fleischwolf-node/fleischwolf.*.node
          if-no-files-found: error

      # The JS loader + types are platform-agnostic; upload them once (from the
      # linux-x64 build) for the publish job to include in the main package.
      - name: Upload JS binding
        if: matrix.target == 'x86_64-unknown-linux-gnu'
        uses: actions/upload-artifact@v4
        with:
          name: js-binding
          path: |
            crates/fleischwolf-node/native.js
            crates/fleischwolf-node/native.d.ts
          if-no-files-found: error

  publish:
    name: publish to npm
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.tag }}

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          registry-url: "https://registry.npmjs.org"

      - name: Install napi CLI
        run: npm install

      # Prebuilt binaries → artifacts/<name>/fleischwolf.<triple>.node
      - name: Download prebuilt binaries
        uses: actions/download-artifact@v4
        with:
          pattern: bindings-*
          path: crates/fleischwolf-node/artifacts

      # The JS loader + types → the package root.
      - name: Download JS binding
        uses: actions/download-artifact@v4
        with:
          name: js-binding
          path: crates/fleischwolf-node

      # Version = the explicit override, else the selected tag with its leading `v`.
      - name: Resolve version
        id: ver
        run: |
          v="${{ inputs.version }}"
          if [ -z "$v" ]; then v="${{ inputs.tag }}"; v="${v#v}"; fi
          echo "version=$v" >> "$GITHUB_OUTPUT"
          echo "Publishing fleischwolf@$v from tag ${{ inputs.tag }}"

      # Skip cleanly if this version is already on npm (idempotent re-runs).
      - name: Check if already published
        id: check
        run: |
          v="${{ steps.ver.outputs.version }}"
          if npm view "fleischwolf@$v" version >/dev/null 2>&1; then
            echo "published=true" >> "$GITHUB_OUTPUT"
            echo "fleischwolf@$v is already on npm — skipping."
          else
            echo "published=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Set package version
        if: steps.check.outputs.published == 'false'
        run: npm version "${{ steps.ver.outputs.version }}" --no-git-tag-version --allow-same-version

      # Create the per-platform package dirs and move each prebuilt .node into
      # its dir. `npm publish` then runs `prepublishOnly` (napi prepublish), which
      # publishes the fleischwolf-<triple> packages and wires them into the main
      # package's optionalDependencies before the main package is published.
      - name: Assemble platform packages
        if: steps.check.outputs.published == 'false'
        run: |
          npx napi create-npm-dir -t .
          npx napi artifacts --dir artifacts

      - name: Publish
        if: steps.check.outputs.published == 'false'
        run: npm publish --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}