publish-metaboost-signing.yml

# Publish packages/metaboost-signing to the public npm registry.
# Versioning: bump package.json version, then tag metaboost-signing-vX.Y.Z and push.

name: Publish metaboost-signing

on:
  workflow_dispatch:
    inputs:
      dry_run:
        description: "If true, run npm publish --dry-run only (no registry write). Set false to publish the current package version from this ref."
        required: false
        type: boolean
        default: true
  push:
    tags:
      - "metaboost-signing-v*"

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "24"
          cache: "npm"
          registry-url: "https://registry.npmjs.org"

      - name: Pin npm version
        run: npm install -g npm@11.13.0

      - name: Install dependencies
        run: |
          set -euo pipefail
          for attempt in 1 2 3 4 5; do
            if npm ci; then
              break
            fi
            echo "npm ci failed (attempt $attempt/5); retrying in 15s..." >&2
            sleep 15
            if [[ "$attempt" -eq 5 ]]; then
              exit 1
            fi
          done

      - name: Verify tag matches package version
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
        env:
          REF: ${{ github.ref }}
        run: |
          TAG_VER="${REF#refs/tags/metaboost-signing-v}"
          PKG_VER=$(node -p "require('./packages/metaboost-signing/package.json').version")
          if [ "$TAG_VER" != "$PKG_VER" ]; then
            echo "Tag version ($TAG_VER) must equal packages/metaboost-signing/package.json version ($PKG_VER)."
            exit 1
          fi

      - name: Build and test package
        run: |
          npm run build -w metaboost-signing
          npm run test -w metaboost-signing
          npm run lint -w metaboost-signing

      - name: Publish to npm (dry run)
        if: github.event_name == 'workflow_dispatch' && inputs.dry_run
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish -w metaboost-signing --access public --dry-run

      - name: Publish to npm
        if: github.event_name != 'workflow_dispatch' || !inputs.dry_run
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish -w metaboost-signing --access public