name: Publish to npm

# Publishes @openhands/extensions to npm via OIDC trusted publishing (no token).
# Fires when release-please pushes a version tag (v*) cut from main; the manual
# dispatch path re-publishes a specific tag. Trusted publishing must be
# configured for this package on npmjs.com (this repo + this workflow file).
on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag to publish (e.g. v0.1.0)'
        required: true
        type: string

concurrency:
  group: npm-publish-${{ inputs.tag || github.ref }}
  cancel-in-progress: false

permissions:
  contents: read
  id-token: write

jobs:
  publish:
    name: Publish to npm
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - name: Check out repository
        uses: actions/checkout@v6
        with:
          ref: ${{ inputs.tag || github.ref }}

      # Trusted publishing requires Node 22.14.0+ and npm 11.5.1+
      # See: https://docs.npmjs.com/trusted-publishers/
      - name: Set up Node.js for npm trusted publishing
        uses: actions/setup-node@v6
        with:
          node-version: '24'
          registry-url: https://registry.npmjs.org

      - name: Verify npm version supports trusted publishing
        run: |
          echo "Node version: $(node --version)"
          echo "npm version: $(npm --version)"
          NPM_VERSION=$(npm --version)
          NPM_MAJOR=$(echo $NPM_VERSION | cut -d. -f1)
          NPM_MINOR=$(echo $NPM_VERSION | cut -d. -f2)
          if [ "$NPM_MAJOR" -lt 11 ] || ([ "$NPM_MAJOR" -eq 11 ] && [ "$NPM_MINOR" -lt 5 ]); then
            echo "Error: npm 11.5.1+ required for trusted publishing, got $NPM_VERSION"
            exit 1
          fi
          echo "✓ npm $NPM_VERSION meets trusted publishing requirements"

      # No install/test/build steps: @openhands/extensions ships source directly
      # (plain ESM + hand-written .d.ts + JSON catalogs) with only peerDependencies,
      # and has no build script, test suite, or lockfile.

      - name: Verify package contents
        run: npm pack --dry-run

      - name: Validate package version matches release tag
        env:
          # Pass inputs.tag via env var to prevent script injection from
          # GitHub Actions expression interpolation inside run blocks.
          INPUT_TAG: ${{ inputs.tag }}
        run: |
          PACKAGE_VERSION=$(node -p "require('./package.json').version")
          # Resolve tag: prefer workflow_dispatch input, fall back to push-event GITHUB_REF
          if [ -n "$INPUT_TAG" ]; then
            RAW_TAG="$INPUT_TAG"
          else
            RAW_TAG="${GITHUB_REF#refs/tags/}"
          fi
          TAG_VERSION="${RAW_TAG#v}"
          echo "Package version: $PACKAGE_VERSION"
          echo "Release tag version: $TAG_VERSION"
          if [ "$PACKAGE_VERSION" != "$TAG_VERSION" ]; then
            echo "Error: package.json version ($PACKAGE_VERSION) doesn't match release tag ($TAG_VERSION)"
            exit 1
          fi
          echo "✓ Version $PACKAGE_VERSION matches release tag"

      - name: Publish to npm with provenance
        run: npm publish --access public --provenance