---
name: Publish

on:
  push:
    branches:
      - main

# Never cancel an in-progress release: a half-published release is worse than a queued one.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read # read repository contents

jobs:
  Linter:
    name: Lint
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      statuses: write # report lint status on the commit
      contents: read # read repository contents
      packages: read # read GitHub Packages
      issues: write # comment on related issues
      pull-requests: write # comment on related pull requests

    steps:
      - name: Run PR Lint
        # https://github.com/ivuorinen/actions
        uses: ivuorinen/actions/pr-lint@94a4f68a6b95ecc1677fbcac1683119fd869adf7 # v2026.07.04

  publish:
    name: Publish
    runs-on: ubuntu-latest
    needs:
      - Linter
    # Dedicated environment scopes the release credential (PAT) and lets you
    # attach protection rules to the publish step. npm auth uses Trusted
    # Publishing (OIDC) via id-token below, so no NPM_TOKEN is needed.
    environment: release
    permissions:
      contents: write # to be able to publish a GitHub release
      issues: write # to be able to comment on released issues
      pull-requests: write # to be able to comment on released pull requests
      id-token: write # to enable use of OIDC for npm provenance

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup Node.js Environment
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          # No always-auth / NPM_TOKEN: the package is published via npm Trusted
          # Publishing (OIDC), which uses the id-token below instead of a token.
          node-version-file: '.nvmrc'
          registry-url: 'https://registry.npmjs.org'
          scope: '@ivuorinen'

      - name: Install and enable corepack
        shell: sh
        run: corepack enable

      - name: Cache Node Modules
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: node_modules
          # Include .nvmrc so a Node version bump invalidates caches that may
          # contain native modules built against the previous Node ABI.
          key: node-modules-${{ hashFiles('.nvmrc', '**/yarn.lock') }}

      # Unconditional and immutable: a package.json-only change keeps the cache
      # key, and skipping the install on a hit would release against a stale
      # tree (semantic-release reads its rules from node_modules).
      - name: Install Dependencies
        shell: bash
        run: yarn install --immutable --mode=skip-build

      # No extra_plugins: the action would npm-install them unpinned, with
      # install scripts, in this credentialed job. The config's plugins
      # (commit-analyzer, release-notes-generator, npm, github) ship inside
      # semantic-release itself.
      - name: Semantic Release
        uses: cycjimmy/semantic-release-action@d9bf53a078bd2f86aaffaec796dbb3d28f1b6f34 # v8.1.3
        env:
          GITHUB_TOKEN: ${{ secrets.PAT }}