# Publish the kit to npm, with provenance.
#
# ── This workflow does nothing until you turn it on ──────────────────────────
# It is `workflow_dispatch` only and it stops immediately unless `NPM_TOKEN` is
# set. A freshly scaffolded kit must not try to publish itself on first push,
# and a workflow that fails on day one is a workflow people learn to ignore.
#
# ── Turning it on ────────────────────────────────────────────────────────────
#   1. `npm run brand` — the package needs a real name and a real `repository`
#      before any of this works. Provenance attests *against* that field, so a
#      wrong one is worse than a missing one.
#   2. Create an npm **automation** token (a classic token skips 2FA on publish;
#      a granular token works too). Settings → Secrets → Actions → `NPM_TOKEN`.
#   3. Uncomment the `push:` trigger below if you want release PRs opened
#      automatically as changesets land on main.
#
# ── What it does ─────────────────────────────────────────────────────────────
# `changesets/action` has two modes and picks between them on its own:
#
#   • pending changesets exist  → it opens/updates a "Version Packages" PR that
#     consumes them, bumps the version and writes CHANGELOG.md. Nothing is
#     published. You review and merge that PR.
#   • no pending changesets, and the version is not on the registry yet
#     → it publishes.
#
# So the human decision point is merging the version PR, not this file.
#
# ── Why not `npm run release` ────────────────────────────────────────────────
# `scripts/release.mjs` is the *local* path and it asks you to type the version
# to confirm. A confirmation a CI runner can satisfy is not a confirmation, so
# this publishes directly and leans on the same checks running first, plus the
# `prepublishOnly` hook in package.json as the last line of defence.

name: Release

on:
  workflow_dispatch:
  # push:
  #   branches: [main]

# `id-token: write` is what mints the provenance attestation — without it
# `--provenance` fails rather than silently publishing unattested.
permissions:
  contents: write
  pull-requests: write
  id-token: write

concurrency:
  group: release
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Is this configured yet?
        run: |
          if [ -z "${{ secrets.NPM_TOKEN }}" ]; then
            echo "NPM_TOKEN is not set — see the comments at the top of this file."
            echo "Stopping before anything is built."
            exit 1
          fi

      - uses: actions/checkout@v4
        with:
          # Changesets needs the history to work out what has already shipped.
          fetch-depth: 0

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          registry-url: https://registry.npmjs.org

      - run: npm install

      # The same gate as ci.yml. Duplicated deliberately: a release that skipped
      # the checks because "CI already ran on that commit" is exactly how a
      # broken tarball reaches a registry, and a published version cannot be
      # taken back.
      - run: npm run lint
      - run: npm run typecheck
      - run: npm run test:run
      - run: npm run build
      - run: npm run verify
      - run: npm run size
      - run: npm run brand:check

      - uses: changesets/action@v1
        with:
          version: npm run changeset -- version
          publish: npm publish --provenance --access public
          commit: 'chore: version packages'
          title: 'chore: version packages'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_CONFIG_PROVENANCE: true