publish.yml

name: Publish to NPM

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to publish (leave empty for package.json version)'
        required: false
        type: string
      dry_run:
        description: 'Dry run (do not actually publish)'
        required: false
        type: boolean
        default: false

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          registry-url: 'https://registry.npmjs.org'
          scope: '@codepurify'

      - name: Install dependencies
        run: cd packages/nodejs && npm ci

      - name: Run tests
        run: cd packages/nodejs && npm test || true # Allow to pass if no tests exist

      - name: Type check
        run: cd packages/nodejs && npm run typecheck

      - name: Lint
        run: cd packages/nodejs && npm run lint

      - name: Build
        run: cd packages/nodejs && npm run build

      - name: Check package version
        id: version_check
        run: |
          PACKAGE_VERSION=$(node -p "require('./packages/nodejs/package.json').version")
          echo "package_version=$PACKAGE_VERSION" >> $GITHUB_OUTPUT

          if [[ "${{ github.event_name }}" == "push" && "${{ github.ref_type }}" == "tag" ]]; then
            TAG_VERSION=${{ github.ref_name }}
            # Remove 'v' prefix if present
            TAG_VERSION=${TAG_VERSION#v}
            echo "tag_version=$TAG_VERSION" >> $GITHUB_OUTPUT
            
            if [[ "$PACKAGE_VERSION" != "$TAG_VERSION" ]]; then
              echo "❌ Package version ($PACKAGE_VERSION) does not match tag version ($TAG_VERSION)"
              exit 1
            fi
            echo "✅ Package version matches tag version"
          else
            echo "ℹ️ Not a tag push, using package.json version"
          fi

      - name: Determine publish version
        id: publish_version
        run: |
          if [[ -n "${{ github.event.inputs.version }}" ]]; then
            PUBLISH_VERSION="${{ github.event.inputs.version }}"
          else
            PUBLISH_VERSION="${{ steps.version_check.outputs.package_version }}"
          fi
          echo "version=$PUBLISH_VERSION" >> $GITHUB_OUTPUT
          echo "Publishing version: $PUBLISH_VERSION"

      - name: Update package version (if needed)
        if: github.event.inputs.version != ''
        run: cd packages/nodejs && npm version ${{ steps.publish_version.outputs.version }} --no-git-tag-version

      - name: Create npmrc
        run: |
          cat << EOF > .npmrc
          //registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}
          EOF

      - name: Publish to NPM (Dry Run)
        if: github.event.inputs.dry_run == 'true'
        run: cd packages/nodejs && npm publish --dry-run --access public

      - name: Publish to NPM
        if: github.event.inputs.dry_run != 'true'
        run: cd packages/nodejs && npm publish --access public

      - name: Create GitHub Release
        if: github.event_name == 'push' && github.ref_type == 'tag'
        uses: actions/create-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: ${{ github.ref_name }}
          release_name: Release ${{ github.ref_name }}
          draft: false
          prerelease: false
          body: |
            ## Changes in ${{ github.ref_name }}

            Auto-generated release from tag ${{ github.ref_name }}

            ### Installation
            ```bash
            npm install codepurify@${{ steps.publish_version.outputs.version }}
            ```

            ### Verification
            - ✅ Type check passed
            - ✅ Linting passed  
            - ✅ Build successful
            - ✅ Published to NPM

  rollback:
    runs-on: ubuntu-latest
    needs: publish
    if: failure() && github.event_name == 'push' && github.ref_type == 'tag'
    permissions:
      contents: write
      id-token: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          registry-url: 'https://registry.npmjs.org'

      - name: Create npmrc
        run: |
          cat << EOF > .npmrc
          //registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}
          EOF

      - name: Unpublish failed version
        run: |
          PACKAGE_VERSION=$(node -p "require('./packages/nodejs/package.json').version")
          echo "Unpublishing failed version: $PACKAGE_VERSION"
          npm unpublish codepurify@$PACKAGE_VERSION --force || true

      - name: Notify rollback
        uses: actions/github-script@v7
        with:
          script: |
            const tag = context.ref.replace('refs/tags/', '');
            github.rest.issues.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              title: `🚨 Publish failed for ${tag}`,
              body: `The publish workflow failed for tag ${tag}. The version has been unpublished from NPM.\n\nPlease check the workflow logs and fix any issues before retrying.`,
              labels: ['bug', 'publish-failed']
            })