release.yml

name: Release

on:
  push:
    tags:
      - 'v*.*.*' # Triggers on version tags like v1.0.0, v1.2.3, etc.

jobs:
  # Run full test suite before publishing
  test:
    name: Pre-Release Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
      - run: npm ci
      - run: npm run lint
      - run: npm run typecheck
      - run: npm test
      - run: npm run test:live-integration
        env:
          ENABLE_REAL_API_TESTS: 'true'

  # Build and publish to npm
  publish:
    name: Publish to npm
    needs: test
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write # Required for trusted publishing
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Fetch all history for changelog generation

      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          registry-url: 'https://registry.npmjs.org'
          # Node 20 includes npm 10.x, but we need npm 11.5.1+ for OIDC
          # npm 11.x requires Node 20+, so we upgrade npm after Node setup

      # Upgrade npm to 11.5.1+ for OIDC trusted publishing support
      # npm 11.x requires Node 20+ (which we're using)
      - name: Upgrade npm for OIDC
        run: npm install -g npm@latest

      - run: npm ci
      - run: npm run build

      # Extract version from tag (e.g., v1.2.3 -> 1.2.3)
      - name: Extract version from tag
        id: version
        run: |
          VERSION=${GITHUB_REF#refs/tags/v}
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "Extracted version: $VERSION"

      # Verify package.json version matches tag
      - name: Verify version matches tag
        run: |
          CURRENT_VERSION=$(node -p "require('./package.json').version")
          EXPECTED_VERSION="${{ steps.version.outputs.version }}"
          echo "Package.json version: $CURRENT_VERSION"
          echo "Tag version: $EXPECTED_VERSION"
          if [ "$CURRENT_VERSION" != "$EXPECTED_VERSION" ]; then
            echo "Error: package.json version ($CURRENT_VERSION) does not match tag version ($EXPECTED_VERSION)"
            exit 1
          fi
          echo "Version verification passed"

      # Publish to npm using OIDC trusted publishing
      # npm 11.5.1+ automatically uses OIDC token when --provenance is used
      # No NODE_AUTH_TOKEN needed - npm gets the token from GitHub Actions OIDC
      - name: Publish to npm
        run: npm publish --provenance --access public

      # Create GitHub Release
      - name: Create GitHub Release
        uses: softprops/action-gh-release@v1
        with:
          tag_name: ${{ github.ref_name }}
          name: Release ${{ steps.version.outputs.version }}
          body: |
            ## Changes in ${{ steps.version.outputs.version }}

            See [CHANGELOG.md](https://github.com/${{ github.repository }}/blob/main/CHANGELOG.md) for details.

            ### Installation
            ```bash
            npm install soda3-query@${{ steps.version.outputs.version }}
            ```
          draft: false
          prerelease: false