name: Deploy

on:
  push:
    branches:
      - main
      - next
      - alpha
      - beta

jobs:
  main:
    name: Run checks and deploy
    runs-on: [ubuntu-latest]
    permissions:
      contents: write
      id-token: write

    steps:
      - name: Check out Git repository
        uses: actions/checkout@v7

      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 22

      - name: Set GitHub packages registry
        run: |
          npm config set '//npm.pkg.github.com/:_authToken' ${{ secrets.JENKINS_PAT_TOKEN }}
          npm config set @typeform:registry https://npm.pkg.github.com/

      - name: Get yarn cache
        uses: actions/cache@v6
        id: yarn-cache
        with:
          path: node_modules
          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}-${{ hashFiles('.github/workflows/**.yml') }}

      - name: Install Node.js dependencies
        if: steps.yarn-cache.outputs.cache-hit != 'true'
        run: yarn install --frozen-lockfile

      - name: Build
        run: yarn build

      - name: Run linting
        run: yarn lint

      - name: Reset npm registry for publishing
        run: |
          npm config set @typeform:registry https://registry.npmjs.org/
          npm config delete '//npm.pkg.github.com/:_authToken'

      - name: Release
        run: yarn semantic-release
        env:
          GH_TOKEN: ${{ secrets.JENKINS_PAT_TOKEN }}
          # OIDC publishing (with provenance) is enabled via id-token: write permission
          # No NPM_TOKEN needed — @semantic-release/npm v13 uses OIDC automatically