publish.yml

name: Publish to npm

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read
  id-token: write
  actions: read

jobs:
  verify-ci:
    runs-on: ubuntu-latest
    steps:
      - name: Wait for CI workflow and verify it passed
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          echo "Waiting for CI workflow to complete for commit ${{ github.sha }}..."

          MAX_ATTEMPTS=30
          INTERVAL=10

          for i in $(seq 1 $MAX_ATTEMPTS); do
            CONCLUSION=$(gh api "repos/${{ github.repository }}/actions/workflows/ci.yml/runs?head_sha=${{ github.sha }}&event=push&branch=main" \
              --jq '.workflow_runs[0].conclusion')

            if [ -n "$CONCLUSION" ] && [ "$CONCLUSION" != "null" ]; then
              break
            fi

            echo "Attempt $i/$MAX_ATTEMPTS: CI not yet completed, waiting ${INTERVAL}s..."
            sleep $INTERVAL
          done

          if [ -z "$CONCLUSION" ] || [ "$CONCLUSION" = "null" ]; then
            echo "::error::CI workflow did not complete within $((MAX_ATTEMPTS * INTERVAL))s for commit ${{ github.sha }}."
            exit 1
          fi

          if [ "$CONCLUSION" = "success" ]; then
            echo "CI passed ✓"
          else
            echo "::error::CI workflow did not succeed (conclusion: $CONCLUSION). Fix CI before publishing."
            exit 1
          fi

  publish:
    needs: verify-ci
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Verify tag is on main branch
        run: |
          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
            echo "::error::Tag points to commit $GITHUB_SHA which is not on main branch"
            exit 1
          fi
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          registry-url: "https://registry.npmjs.org"
      - name: Remove local-only dependencies
        run: node -e "const p=require('./package.json'); delete p.devDependencies.geonicdb; delete p.devDependencies.mongodb; require('fs').writeFileSync('package.json', JSON.stringify(p, null, 2)+'\n')"
      - run: npm install
      - name: Verify tag matches package version
        run: |
          PKG_VERSION="v$(node -p "require('./package.json').version")"
          TAG="${GITHUB_REF#refs/tags/}"
          if [ "$PKG_VERSION" != "$TAG" ]; then
            echo "::error::Tag $TAG does not match package.json version $PKG_VERSION"
            exit 1
          fi
      - run: npm run build
      - name: Upgrade npm for OIDC Trusted Publishing
        run: corepack enable npm && corepack install -g npm@11
      - name: Publish to npm (OIDC Trusted Publishing)
        run: npm publish --provenance