release-on-npm.yaml

name: Release on NPM

on:
    push:
        tags:
            - 'v*.*.*'

permissions:
    id-token: write # Required for OIDC
    contents: read

concurrency:
    group: release-on-npm-${{ github.ref_name }}
    cancel-in-progress: false

jobs:
    release:
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
              with:
                  ref: ${{ github.ref }}
                  persist-credentials: false
                  fetch-depth: 0

            - name: Verify tag is on the main branch
              run: |
                  set -euo pipefail
                  git fetch --no-tags origin refs/heads/main:refs/remotes/origin/main
                  if ! git merge-base --is-ancestor "${GITHUB_SHA}" refs/remotes/origin/main; then
                      echo "::error::Tag ${GITHUB_REF_NAME} (${GITHUB_SHA}) is not an ancestor of main. Refusing to publish."
                      exit 1
                  fi
                  echo "Tag ${GITHUB_REF_NAME} verified as ancestor of main."

            # Pinned explicitly to avoid pulling a compromised "latest" at release time; bump via dedicated PR.
            - run: npm i -g corepack@0.35.0 && corepack enable
              # setup-node does not enable any package-manager cache here (no `cache:` input),
              # so cache poisoning is not a concern on this release workflow.
            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # zizmor: ignore[cache-poisoning] v6.4.0
              with:
                  registry-url: 'https://registry.npmjs.org'
                  node-version-file: '.nvmrc'

              # npm 11.5.1 or later is required for OIDC. Pinned explicitly to avoid
              # pulling a compromised "latest" at release time; bump via dedicated PR.
            - run: npm install -g npm@11.16.0

            - name: Install root JS dependencies
              run: pnpm install --frozen-lockfile

            - name: Publish on NPM
              run: pnpm publish --recursive --access public --no-git-checks --provenance