name: Publish

on:
  push:
    branches:
      - main

concurrency: ${{ github.workflow }}-${{ github.ref }}

# Disable all permissions by default, requiring explicit permission definitions for all jobs.
permissions: {}

jobs:
  check:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          package-manager-cache: false
      - run: corepack enable
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          cache: pnpm
          package-manager-cache: false
      - run: pnpm ci
      - run: pnpm run check

  changesets:
    needs: check
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    outputs:
      published: ${{ steps.changesets.outputs.published }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          # Disable package manager cache to so that other jobs can't poison the cache.
          package-manager-cache: false
      - run: corepack enable
      - name: Install dependencies
        run: pnpm ci
      - name: Create release pull request or GitHub release
        id: changesets
        uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1.7.0
        with:
          version: pnpm run bump
          publish: pnpm run tag

  build:
    needs: changesets
    if: needs.changesets.outputs.published == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      tarball: ${{ steps.pack.outputs.tarball }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          # Disable package manager cache to so that other jobs can't poison the cache.
          package-manager-cache: false
      - run: corepack enable
      - name: Install dependencies
        run: pnpm ci
      - name: Build & pack the package
        id: pack
        run: |
          pnpm run build
          TARBALL=$(npm pack)
          echo "tarball=${TARBALL}" >> ${GITHUB_OUTPUT}
      - name: Upload build artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: tarball
          path: ${{ steps.pack.outputs.tarball }}

  publish:
    environment: publish
    needs:
      - changesets
      - build
    if: needs.changesets.outputs.published == 'true'
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    steps:
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          # Disable package manager cache to so that other jobs can't poison the cache.
          package-manager-cache: false
      - name: Download build artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: tarball
      - name: Publish to npm
        run: npm publish ${TARBALL}
        env:
          TARBALL: ${{ needs.build.outputs.tarball }}