name: Publish package to NPM Registry
run-name: ${{ github.actor }} started publish action
on:
  push:
    tags:
      - 'v*.*.*'

  # Allows to run this workflow manually from the Actions tab
  workflow_dispatch:

# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
concurrency:
  group: '${{ github.workflow }}-${{ github.ref }}'
  cancel-in-progress: true

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      # Give permission to mint an ID-token for publishing package with provenance
      id-token: write
    steps:
      - uses: actions/checkout@v4

      - name: Use Node.js 24
        uses: actions/setup-node@v4
        with:
          node-version: '24.x'
          registry-url: 'https://registry.npmjs.org'

      - name: Install dependencies
        run: npm install

      - name: Run Linters
        run: npm run lint

      # npm CLI v11.5.1+ required for OIDC trusted publishing
      # Provenance is automatic with trusted publishing
      - name: Publish with OIDC
        run: npm publish --access public

  # Notification Job
  notify_job:
    runs-on: ubuntu-latest
    needs: [publish]
    if: ${{ always() }}
    steps:
      - name: Notify Failure on Ntfy
        if: ${{ contains(needs.*.result, 'failure') }}
        run: |
          curl \
            -H "Authorization: Bearer ${{ secrets.NTFY_TOKEN }}" \
            -H "Title: Publish Job Failed" \
            -H "Priority: urgent" \
            -H "Tags: warning,x" \
            -H "Content-Type: text/plain" \
            -d $'Repo: ${{ github.repository }}\nCommit: ${{ github.sha }}\nRef: ${{ github.ref }}\nStatus: ${{ job.status}}' \
            ${{ secrets.NTFY_URL }}

      - name: Notify Cancellation on Ntfy
        if: ${{ contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped') }}
        run: |
          curl \
            -H "Authorization: Bearer ${{ secrets.NTFY_TOKEN }}" \
            -H "Title: Publish Job Cancelled/Skipped" \
            -H "Priority: urgent" \
            -H "Tags: warning,x" \
            -H "Content-Type: text/plain" \
            -d $'Repo: ${{ github.repository }}\nCommit: ${{ github.sha }}\nRef: ${{ github.ref }}\nStatus: ${{ job.status}}' \
            ${{ secrets.NTFY_URL }}

      - name: Notify Publish Completion on Ntfy
        # https://docs.github.com/en/actions/learn-github-actions/contexts#needs-context
        if: ${{ success() && !(contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped')) }}
        run: |
          curl \
            -H "Authorization: Bearer ${{ secrets.NTFY_TOKEN }}" \
            -H "Title: Publish Job Successful" \
            -H "Priority: default" \
            -H "Tags: white_check_mark" \
            -H "Content-Type: text/plain" \
            -d $'Repo: ${{ github.repository }}\nCommit: ${{ github.sha }}\nRef: ${{ github.ref }}\nStatus: ${{ job.status}}' \
            ${{ secrets.NTFY_URL }}