name: publish

on:
  push:
    tags: ['v*']
  workflow_dispatch:

permissions:
  id-token: write
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
      # Enable corepack so pnpm is available.
      - name: Enable corepack and activate pnpm
        run: corepack enable && corepack prepare pnpm@11.12.0 --activate
      # Install all workspace packages so peer deps are satisfied.
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      # Trusted publishing (OIDC) needs pnpm >= 9 with provenance support.
      # If OIDC fails, uncomment the fallback: npm publish
      - name: Publish with OIDC provenance
        run: pnpm publish