name: Setup
description: >-
  Install pnpm and Node, authenticate to the private @raredays npm registry, then
  install dependencies. The @raredays/* packages are published with restricted
  access, so the registry token must be present before install. pnpm ignores
  ${VAR} interpolation in a committed project .npmrc (it could leak the token to
  an attacker-controlled registry), so the token is written to the user-level
  ~/.npmrc at runtime instead.

inputs:
  node-auth-token:
    description: >-
      npm token with read access to the private @raredays registry. Pass it from
      the NODE_AUTH_TOKEN repository secret.
    required: true

runs:
  using: composite
  steps:
    - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
    - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
      with:
        node-version: 24
        cache: pnpm
    - name: Authenticate to the npm registry
      shell: bash
      env:
        NODE_AUTH_TOKEN: ${{ inputs.node-auth-token }}
      run: |
        if [ -z "$NODE_AUTH_TOKEN" ]; then
          echo "::error::NODE_AUTH_TOKEN is empty. Add a repository secret with an npm token that has read access to the private @raredays registry."
          exit 1
        fi
        echo "//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}" >> ~/.npmrc
    - name: Install dependencies
      shell: bash
      run: pnpm install --frozen-lockfile