release-on-npm.yaml

name: Release on NPM

on:
    push:
        tags:
            - 'v*.*.*'

permissions:
    id-token: write # Required for OIDC
    contents: read

concurrency:
    group: release-on-npm-${{ github.ref_name }}
    cancel-in-progress: false

jobs:
    release:
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
              with:
                  ref: ${{ github.ref }}
                  persist-credentials: false
                  fetch-depth: 0

            - name: Verify tag is on the main branch
              run: |
                  set -euo pipefail
                  git fetch --no-tags origin refs/heads/main:refs/remotes/origin/main
                  if ! git merge-base --is-ancestor "${GITHUB_SHA}" refs/remotes/origin/main; then
                      echo "::error::Tag ${GITHUB_REF_NAME} (${GITHUB_SHA}) is not an ancestor of main. Refusing to publish."
                      exit 1
                  fi
                  echo "Tag ${GITHUB_REF_NAME} verified as ancestor of main."

            - uses: pnpm/setup@84cb39b217b10273981911c288cd62326dc7c6d2 # v2.0.2

              # setup-node is kept here only for its `registry-url` input, which is what wires
              # npm OIDC trusted publishing. It gets no `node-version`, so it installs nothing:
              # pnpm/setup already provisioned Node from `devEngines.runtime`.
              # setup-node does not enable any package-manager cache here (no `cache:` input),
              # so cache poisoning is not a concern on this release workflow.
            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # zizmor: ignore[cache-poisoning] v7.0.0
              with:
                  registry-url: 'https://registry.npmjs.org'

              # npm 11.5.1 or later is required for OIDC. Pinned explicitly to avoid
              # pulling a compromised "latest" at release time; bump via dedicated PR.
            - run: npm install -g npm@11.16.0

            - name: Publish on NPM
              run: pnpm publish --recursive --access public --no-git-checks --provenance