release.yml

# Publishes to npm via OIDC trusted publishing — no NPM_TOKEN.
# Prerequisite: this repo + this workflow must be registered as a Trusted
# Publisher for the package on npmjs.org (package → Settings → Trusted
# Publishers), otherwise the publish step fails with an auth error.
name: Publish Package on Release

on:
  release:
    types: [published]

jobs:
  publish:
    runs-on: ubuntu-24.04
    # Manual approval gate: the `release` Environment must have required
    # reviewers configured in repo Settings, else this pauses for no one.
    environment: release
    permissions:
      contents: read
      id-token: write
      attestations: write # Write SLSA build provenance to the attestation store

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # No git writes here (publish uses npm OIDC, not git creds), so don't persist creds.
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: ".nvmrc"
          registry-url: https://registry.npmjs.org
          package-manager-cache: false # Prevent cache poisoning issues

      - name: Ensure npm supports trusted publishing
        # OIDC trusted publishing requires npm >= 11.5.1. The .nvmrc Node may
        # bundle an older npm, so pin the floor explicitly: stays on the
        # vetted 11.x major, avoids a surprise npm major in a release run.
        run: npm install -g npm@^11.5.1

      - name: Enable Corepack
        run: corepack enable

      - name: Install dependencies
        run: yarn install --immutable

      - name: Setup Compact Compiler
        uses: midnightntwrk/setup-compact-action@836895c8fffbbea6bd986af2b17e8941ff29d1f8 # v1
        with:
          compact-version: "0.34.0"

      - name: Build contracts
        run: yarn build

      - name: Validate version consistency
        run: |
          RELEASE_VERSION=${GITHUB_REF#refs/tags/v}
          PACKAGE_VERSION=$(node -p "require('./contracts/package.json').version")
          if [ "$RELEASE_VERSION" != "$PACKAGE_VERSION" ]; then
            echo "❌ Version mismatch: Release $RELEASE_VERSION vs Package $PACKAGE_VERSION"
            exit 1
          fi
          echo "✅ Version consistency validated: $RELEASE_VERSION"

      - name: Pack tarball
        id: pack
        run: |
          cd contracts/dist
          TARBALL=$(npm pack | tail -1)
          echo "tarball_name=$TARBALL" >> $GITHUB_OUTPUT
          echo "tarball=$(pwd)/$TARBALL" >> $GITHUB_OUTPUT

          # Determine dist-tag based on semver prerelease
          PACKAGE_VERSION=$(node -p "require('./package.json').version")
          if [[ "$PACKAGE_VERSION" =~ -.*$ ]]; then
            # Has prerelease suffix (anything after -)
            if [[ "$PACKAGE_VERSION" =~ -(alpha|beta|rc) ]]; then
              echo "tag=beta" >> $GITHUB_OUTPUT
            else
              echo "tag=next" >> $GITHUB_OUTPUT
            fi
          else
            # Stable release
            echo "tag=latest" >> $GITHUB_OUTPUT
          fi

      - name: Verify tarball integrity
        run: |
          echo "=== Verifying tarball contents ==="
          PACKAGE_NAME=$(tar xfO "${{ steps.pack.outputs.tarball }}" package/package.json | jq -r .name)
          PACKAGE_VERSION=$(tar xfO "${{ steps.pack.outputs.tarball }}" package/package.json | jq -r .version)
          PRIVATE_FIELD=$(tar xfO "${{ steps.pack.outputs.tarball }}" package/package.json | jq -r '.private // "not found"')

          echo "📦 Package: $PACKAGE_NAME@$PACKAGE_VERSION"
          echo "🏷️  Tag: ${{ steps.pack.outputs.tag }}"
          echo "🔒 Private field: $PRIVATE_FIELD"

          # Ensure no private field
          if [ "$PRIVATE_FIELD" = "true" ]; then
            echo "❌ Tarball contains private: true - cannot publish"
            exit 1
          fi

      - name: Attest build provenance
        # Signed SLSA v1 provenance over the exact tarball, stored in the
        # GitHub attestation store (verifiable with `gh attestation verify`).
        # Complements the npm-registry provenance from NPM_CONFIG_PROVENANCE.
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: ${{ steps.pack.outputs.tarball }}

      - name: Publish to npm
        run: |
          # Publish the tarball with appropriate tag
          npm publish "${{ steps.pack.outputs.tarball }}" --tag "${{ steps.pack.outputs.tag }}" --access public
        env:
          # No NODE_AUTH_TOKEN — OIDC trusted publishing mints per-run credentials.
          NPM_CONFIG_PROVENANCE: true

      - name: Log success
        run: |
          PACKAGE_NAME=$(tar xfO "${{ steps.pack.outputs.tarball }}" package/package.json | jq -r .name)
          PACKAGE_VERSION=$(tar xfO "${{ steps.pack.outputs.tarball }}" package/package.json | jq -r .version)
          echo "✅ Successfully published $PACKAGE_NAME@$PACKAGE_VERSION to npm with tag ${{ steps.pack.outputs.tag }}"
          echo "📦 Install with: npm install $PACKAGE_NAME@${{ steps.pack.outputs.tag }}"