publish.yml

name: Publish Package

on:
  push:
    branches:
      - main
  workflow_dispatch: {}

permissions: {}

jobs:
  publish:
    runs-on: ubuntu-latest

    permissions:
      id-token: write # Required for OIDC trusted publishing / npm provenance
      contents: write # Required to create and push tags

    steps:
      # v4.2.2
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8

      # v4.1.0
      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444
        with:
          node-version: "22"
          registry-url: "https://registry.npmjs.org"

      - name: Update npm
        # npm >= 11.5.1 is required for OIDC trusted publishing
        run: npm install -g npm@11.11.1

      - run: npm ci
      - run: npm run build
      - run: npm test

      - name: Publish to npm
        run: |
          PACKAGE_NAME=$(jq -r '.name' package.json)
          PACKAGE_VERSION=$(jq -r '.version' package.json)
          if npm view "$PACKAGE_NAME" versions | grep -q "\"$PACKAGE_VERSION\""; then
            echo "$PACKAGE_NAME@$PACKAGE_VERSION already exists on npm. Skipping publish."
          else
            echo "Publishing $PACKAGE_NAME@$PACKAGE_VERSION..."
            npm publish --ignore-scripts --provenance --access public
          fi

      - name: Create and push tag
        if: github.event_name == 'push' && contains(github.event.head_commit.message, 'Bump version to')
        run: |
          git config --global user.name "github-actions[bot]"
          git config --global user.email "github-actions[bot]@users.noreply.github.com"
          VERSION=$(jq -r '.version' package.json)
          if git rev-parse "v${VERSION}" >/dev/null 2>&1; then
            echo "Tag v${VERSION} already exists. Skipping."
          else
            git tag -a "v${VERSION}" -m "v${VERSION}"
            git push origin "v${VERSION}"
          fi