publish.yaml

name: Release Package
on:
  push:
    tags:
      - v*

jobs:
  release:
    name: Create GitHub Release
    runs-on: ubuntu-latest

    permissions:
      contents: write

    steps:
      - name: Checkout source
        uses: actions/checkout@v7

      - name: Get package version
        id: get-package-version
        shell: bash
        run: |
          echo "version=$(cat package.json  | jq -r .version)" >> $GITHUB_OUTPUT

      - name: Ensure tag matches package versions
        shell: bash
        run: |
          test "${{ github.ref_name }}" == "v${{ steps.get-package-version.outputs.version }}"

      - name: Create Release
        uses: ncipollo/release-action@v1
        with:
          tag: "${{ github.ref_name }}"
          generateReleaseNotes: true
          makeLatest: true

  publish:
    name: Publish Package
    runs-on: ubuntu-latest
    needs: release

    permissions:
      contents: read
      id-token: write

    steps:
      - uses: actions/checkout@v7

      - name: Setup build environment
        uses: ./.github/actions/setup

      - name: Build distribution
        shell: bash
        run: pnpm build

      - name: Publish package
        run: pnpm publish --no-git-checks --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_CONFIG_PROVENANCE: true