publish.yml

name: Publish

on:
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: read
  id-token: write

concurrency:
  group: npm-publish
  cancel-in-progress: false

jobs:
  publish:
    runs-on: ubuntu-latest
    environment: npm

    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: "22.19.0"
          cache: npm

      # npm Trusted Publishing requires a recent npm CLI.
      - name: Update npm
        run: npm install --global npm@11

      - name: Check tag matches package version
        run: |
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          PACKAGE_VERSION="$(node -p "require('./package.json').version")"

          echo "Tag version: $TAG_VERSION"
          echo "Package version: $PACKAGE_VERSION"

          test "$TAG_VERSION" = "$PACKAGE_VERSION"

      - name: Prepare Pi config directory
        run: mkdir -p "$HOME/.pi/agent"

      - name: Install dependencies
        run: npm ci

      - name: Verify
        run: npm run verify

      - name: Check package contents
        run: npm run pack:check

      - name: Publish to npm
        run: npm publish --access public --provenance