publish.yml

name: Publish

on:
  push:
    tags:
      - 'v*'

jobs:
  publish:
    runs-on: ubuntu-latest
    # Publishing uses npm Trusted Publishing (OIDC) — no NPM_TOKEN secret.
    # One-time setup on npmjs.com: package gnss-js → Settings → Trusted
    # Publisher → GitHub Actions, repository MiguelPuntoEs/gnss-js,
    # workflow filename publish.yml.
    permissions:
      contents: write # create the GitHub Release
      id-token: write # npm OIDC auth + provenance
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          version: 10
      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: pnpm
      # Trusted Publishing needs npm >= 11.5 — Node 24 bundles it,
      # no unpinned npm@latest install in the OIDC-privileged workflow.
      - run: pnpm install --frozen-lockfile
      # BKG/ESA are intermittently unreachable from GitHub runners; the
      # fetch script skips existing files, so a cache hit is a no-op.
      - name: Cache test fixtures
        uses: actions/cache@v4
        with:
          path: test-fixtures
          key: test-data-${{ hashFiles('scripts/fetch-test-data.sh') }}
          restore-keys: |
            test-data-
      - run: bash scripts/fetch-test-data.sh
      - run: pnpm run lint
      - run: npx tsc --noEmit
      - run: pnpm test
      - run: pnpm run build
      - name: Check tag matches package.json version
        run: |
          PKG_VERSION="v$(node -p "require('./package.json').version")"
          if [ "$PKG_VERSION" != "$GITHUB_REF_NAME" ]; then
            echo "Tag $GITHUB_REF_NAME does not match package.json $PKG_VERSION" >&2
            exit 1
          fi
      - name: Publish to npm (OIDC)
        run: npm publish --provenance --access public
      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "$GITHUB_REF_NAME" \
            --title "$GITHUB_REF_NAME" \
            --notes "See [CHANGELOG.md](https://github.com/MiguelPuntoEs/gnss-js/blob/main/CHANGELOG.md)."