# Publishes to npm when a GitHub Release is published.
#
# Uses npm Trusted Publishing (OIDC) — no token/secret to manage or rotate.
# One-time setup:
#   1. On https://www.npmjs.com/package/anbani/access add a trusted publisher:
#      GitHub repository "Anbani/anbani.js", workflow "publish.yml",
#      environment left blank.
#   2. Create a GitHub Release to trigger this workflow.
#
# `npm publish` runs the `prepublishOnly` script first, which rebuilds the
# dist/ bundle and runs the test suite, so a stale bundle can never ship.
# Trusted publishing also attaches build provenance automatically.
name: publish

on:
  release:
    types: [published]
  # Manual escape hatch: a release whose tag predates a fix to this workflow can't
  # be re-run against the fixed version, since the release event replays the
  # workflow file as it existed at the tag. Dispatch from the default branch instead.
  workflow_dispatch:

jobs:
  npm:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write   # required for trusted publishing (OIDC)
    steps:
      - uses: actions/checkout@v4

      # OIDC trusted publishing needs npm >= 11.5.1. Node 24 bundles npm 11.16,
      # so take it from the runtime rather than self-upgrading npm in place —
      # `npm install -g npm@latest` overwrites the running npm and leaves it
      # unable to resolve its own deps ("Cannot find module 'sigstore'").
      # (npm 12 also requires Node >= 22.22, so it can't install on Node 20 at all.)
      - uses: actions/setup-node@v4
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      - run: npm install

      - run: npm publish