npm-publish.yml

name: Release — Core (npm + GitHub Packages)

on:
  push:
    tags:
      - 'v[0-9]*'

permissions:
  contents: write   # create GitHub Releases
  id-token: write   # npm provenance
  packages: write   # GitHub Packages

jobs:
  # ── 1. Gate: all tests must pass ─────────────────────────────────────────
  test:
    name: Test (Node 20)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
      - name: Run test suite
        run: node test/run.js

  # ── 2. Publish to npmjs.com ───────────────────────────────────────────────
  publish-npm:
    name: Publish → npmjs.com
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
          registry-url: 'https://registry.npmjs.org'

      - name: Verify package version matches tag
        run: |
          PKG_VERSION="v$(node -p "require('./package.json').version")"
          TAG_VERSION="${GITHUB_REF_NAME}"
          if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then
            echo "ERROR: package.json version ($PKG_VERSION) does not match tag ($TAG_VERSION)"
            exit 1
          fi
          echo "✓ version check passed: $PKG_VERSION"

      - name: Verify npm registry and token
        run: |
          echo "NPM Registry: $(npm config get registry)"
          echo "Token set: $([ -n "$NODE_AUTH_TOKEN" ] && echo 'yes' || echo 'no')"
          echo "Token length: ${#NODE_AUTH_TOKEN}"
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Publish to npm
        run: |
          # NPM_TOKEN must be an 'Automation' token from npmjs.org settings
          # (not requiring 2FA in CI/CD environments)
          npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

  # ── 3. Publish to GitHub Packages (scoped) ───────────────────────────────
  publish-github:
    name: Publish → GitHub Packages
    needs: test
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
          registry-url: 'https://npm.pkg.github.com'
          scope: '@manojmallick'

      - name: Publish to GitHub Packages
        run: |
          node -e "
            const fs = require('fs');
            const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
            pkg.name = '@manojmallick/sigmap';
            pkg.publishConfig = { registry: 'https://npm.pkg.github.com' };
            fs.writeFileSync('package.json', JSON.stringify(pkg, null, 2) + '\n');
          "
          npm publish --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # ── 4. Create GitHub Release (npm only) ──────────────────────────────────
  release:
    name: Create GitHub Release
    needs: [publish-npm, publish-github]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          make_latest: true