on:
  release:
    types:
      - published
  workflow_dispatch:

jobs:
  bump-version:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v6
      - name: Install node
        uses: actions/setup-node@v6
        with:
          node-version: "24"
      - run: echo "nextVersion=$(npm version --no-git-tag minor)" >> $GITHUB_ENV
      - name: Push version bump branch
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git checkout -b feature/bump-core-ui-version-to-${{ env.nextVersion }}
          git add package.json package-lock.json
          git commit -m "Bump core-ui version to ${{ env.nextVersion }}"
          git push origin feature/bump-core-ui-version-to-${{ env.nextVersion }}
      - name: Create Pull Request
        uses: actions/github-script@v5
        id: cpr
        with:
          script: |
            const pr = await github.rest.pulls.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              head: `feature/bump-core-ui-version-to-${process.env.nextVersion}`,
              base: context.payload.repository.default_branch,
              title: `Bump core-ui version to ${process.env.nextVersion}`,
              body: ''
            });
            core.setOutput('pull-request-number', String(pr.data.number));
      - name: Merge Pull Request
        uses: actions/github-script@v5
        if: ${{ steps.cpr.outputs.pull-request-number }}
        with:
          github-token: ${{ secrets.GIT_ACCESS_TOKEN }}
          script: |
            await github.rest.pulls.merge({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: ${{ steps.cpr.outputs.pull-request-number }},
              merge_method: 'merge'
            })

  publish-npm:
    runs-on: ubuntu-latest
    permissions:
      id-token: write # Required for OIDC authentication
      contents: read
      packages: read # to install @jbwatenbergscality/storybook-webmcp from GHPR
    environment: npmjs
    steps:
      - uses: actions/checkout@v6
      # Setup .npmrc file to publish to npmjs.org
      - uses: actions/setup-node@v6
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"
      # GHPR auth for @jbwatenbergscality/storybook-webmcp. Appended to the
      # workspace .npmrc (project scope), NOT ~/.npmrc: the repo's own .npmrc
      # already sets `//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}`, and
      # project config outranks ~/.npmrc, so writing to ~/.npmrc gets clobbered
      # by an empty token (NODE_AUTH_TOKEN is unset here) -> 401 on npm ci.
      # Appending to the project .npmrc wins (last line wins within a file).
      # Scoping the token to npm.pkg.github.com only (rather than setting
      # NODE_AUTH_TOKEN) keeps the GitHub token from leaking to npmjs through
      # setup-node's `//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}` line.
      - run: echo "//npm.pkg.github.com/:_authToken=${{ secrets.GITHUB_TOKEN }}" >> .npmrc
      - run: npm ci
      - run: npm run build
      - run: npm publish