jsr_publish.yaml

name: Publish to JSR
on:
  workflow_run:
    workflows: ["Publish"]
    types:
      - completed
  workflow_dispatch:

jobs:
  publish:
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
    permissions:
      contents: read
      id-token: write  # Required for JSR OIDC auth - no token secret needed
    steps:
      - uses: actions/checkout@v5
        with:
          # workflow_run checks out default branch by default - use the commit that triggered Publish
          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
      - uses: actions/setup-node@v4
        with:
          node-version: "lts/*"
      - run: npm ci
      - name: Patch zod version for JSR compatibility
        run: |
          # JSR's npm specifier doesn't support "||" in version ranges (e.g. ^3.25.65 || ^4.0.0)
          # Pin to zod 4 since we use zod/v4-mini
          node -e "
            const fs = require('fs');
            const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
            if (pkg.dependencies?.zod) pkg.dependencies.zod = '^4.0.0';
            fs.writeFileSync('package.json', JSON.stringify(pkg, null, 2));
          "
      - name: Publish to JSR
        run: npx jsr publish --allow-slow-types --allow-dirty