publish.yml

name: Publish to npm

on:
  release:
    types: [published]

permissions:
  contents: read
  id-token: write

jobs:
  publish:
    name: Publish package
    runs-on: ubuntu-latest

    steps:
      - name: Checkout release tag
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.release.tag_name }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24
          registry-url: 'https://registry.npmjs.org'

      - name: Install dependencies
        run: npm ci

      - name: Typecheck
        run: npm run typecheck

      - name: Validate release tag
        run: |
          PACKAGE_VERSION="$(node -p "require('./package.json').version")"
          EXPECTED_TAG="v${PACKAGE_VERSION}"
          RELEASE_TAG="${{ github.event.release.tag_name }}"

          if [ "${RELEASE_TAG}" != "${EXPECTED_TAG}" ]; then
            echo "Release tag ${RELEASE_TAG} does not match package version ${EXPECTED_TAG}."
            exit 1
          fi

      - name: Verify package contents
        run: npm pack --dry-run

      - name: Publish to npm
        run: npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}