name: Publish Package to npm

# Release-driven publish model:
# - build-and-test runs on every code event (PR + push to main + release + manual
#   dispatch). PR-time check satisfies the branch-protection ruleset; the push
#   trigger is the safety net for admin-bypass merges and post-merge sanity on
#   Dependabot auto-merges.
# - publish-npm runs ONLY on a published GitHub Release or a manual
#   workflow_dispatch. Code landing on main does NOT publish — releases are
#   deliberate, versioned ceremonies.
#
# Why this shape: every commit that touches non-md used to trigger publish-npm,
# which (a) failed loudly when no version bump (Dependabot patches, doc
# changes, contributor iterations) and (b) raced with the release event when a
# release was created for the same SHA. Decoupling code-events from
# release-events fixes both classes of failure and aligns with the publish flow
# of mature npm projects (React, Vite, vitest, etc.).

on:
  push:
    branches:
      - main
    paths-ignore:
      - "**.md"
  pull_request:
    branches:
      - main
    paths-ignore:
      - "**.md"
  release:
    types: [published]
  workflow_dispatch: {}

permissions:
  contents: read

jobs:
  build-and-test:
    # Skip GitHub Actions changelog auto-commits to avoid double-runs on bot
    # pushes. The condition only meaningfully applies on push events; on PR /
    # release / dispatch, github.event.head_commit is null, contains() returns
    # false, and the negation runs the job.
    if: ${{ !contains(github.event.head_commit.message, 'update changelog [skip ci]') }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: "22.x"
          cache: "npm"
      - run: npm ci
      - run: npm run build
      - run: npm test

  publish-npm:
    # Only publish on a published GitHub Release (deliberate ceremony) or on
    # manual workflow_dispatch (escape hatch for emergencies). Never on push
    # or pull_request — those are code events, not release events.
    if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
    needs: build-and-test
    runs-on: ubuntu-latest
    environment:
      name: npm-publish
      url: https://www.npmjs.com/package/@yoda.digital/gitlab-mcp-server
    permissions:
      contents: read
      # id-token: write is required for both:
      #   1. npm OIDC trusted publishing (no NPM_TOKEN needed)
      #   2. Sigstore-signed provenance attestations
      id-token: write
    steps:
      - uses: actions/checkout@v6
      # Node 24 LTS Krypton ships with npm 11.12.x natively, which has the
      # OIDC trusted-publishing client (introduced in npm 11.5.1, July 2025).
      # build-and-test stays on Node 22 to mirror the production runtime.
      - uses: actions/setup-node@v6
        with:
          node-version: "24.x"
          registry-url: "https://registry.npmjs.org/"
          scope: "@yoda.digital"
      - run: npm ci
      - run: npm run build
      # No NODE_AUTH_TOKEN. Authentication is via npm Trusted Publishing —
      # configure on npmjs.com:
      #   Package settings → Publishing access → Trusted publisher
      #   Publisher: GitHub Actions
      #   Organization: yoda-digital
      #   Repository: mcp-gitlab-server
      #   Workflow filename: .github/workflows/publish.yml
      #   Environment name: npm-publish
      # Reference: https://docs.npmjs.com/trusted-publishers
      - run: npm publish --provenance --access public