name: CI | Publish npm package
on:
  push:
    tags:
      - 'v*'
permissions:
  contents: write
  packages: write
  id-token: write
jobs:
  build-and-publish:
    # The unscoped `underpost` package has one publisher: a version can be published once, and
    # the organization mirror publishes the owner-scoped package from its ghpkg repository.
    if: (github.repository == 'underpostnet/pwa-microservices-template' || github.repository == 'underpost/pwa-microservices-template')
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
      id-token: write
    steps:
      - uses: actions/checkout@v7

      - name: Install required packages
        run: |
          sudo apt-get update -y
          sudo apt-get install -y sudo tar gzip bzip2 git curl

      - uses: actions/setup-node@v7
        with:
          node-version: '24.x'
          registry-url: 'https://registry.npmjs.org'

      - name: Install Dependencies
        run: npm ci

      # npm accepts a version once: a rerun skips the registry and goes on to the steps after it.
      - name: Check whether this version is already on npm
        id: npm
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          NAME=$(node -p 'require("./package.json").name')
          VERSION=$(node -p 'require("./package.json").version')
          if [ "$(npm view "$NAME@$VERSION" version 2>/dev/null)" = "$VERSION" ]; then
            echo "::notice::$NAME@$VERSION is already on npm; skipping it."
            echo "published=true" >> "$GITHUB_OUTPUT"
          else
            echo "published=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Publish to npm
        if: steps.npm.outputs.published != 'true'
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish --provenance --access public

      - name: Dispatch release CD
        run: |
          curl -s -f -X POST \
            -H "Accept: application/vnd.github.v3+json" \
            -H "Authorization: token ${{ secrets.GIT_AUTH_TOKEN }}" \
            "https://api.github.com/repos/${{ github.repository }}/actions/workflows/release.cd.yml/dispatches" \
            -d '{"ref":"master"}'

  build-and-publish-ghpkg:
    # The scoped package takes the repository owner as its scope, so the personal account and the
    # organization mirror each publish their own; any other owner is a fork.
    if: >-
      github.event.repository.name == 'pwa-microservices-template-ghpkg' &&
      contains(fromJSON('["underpostnet","underpost"]'), github.repository_owner)
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
      id-token: write
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-node@v7
        with:
          node-version: '24.x'
          registry-url: 'https://registry.npmjs.org'
          scope: '@${{ github.repository_owner }}'

      - name: Install Dependencies
        run: npm ci

      # The committed manifest names the personal account. Provenance is refused when the
      # manifest's repository differs from the one the workflow runs in, and GitHub Packages
      # accepts only the owner's scope, so both follow the owner here — a no-op on the source.
      - name: Align the package identity with the repository owner
        run: node bin package --rename "@${{ github.repository_owner }}/underpost" --set-repo "${{ github.repository }}"

      # npm accepts a version once: when it is already there, go straight to GitHub Packages.
      - name: Check whether this version is already on npm
        id: npm
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          NAME=$(node -p 'require("./package.json").name')
          VERSION=$(node -p 'require("./package.json").version')
          if [ "$(npm view "$NAME@$VERSION" version 2>/dev/null)" = "$VERSION" ]; then
            echo "::notice::$NAME@$VERSION is already on npm; skipping it."
            echo "published=true" >> "$GITHUB_OUTPUT"
          else
            echo "published=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Publish to npm
        if: steps.npm.outputs.published != 'true'
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish --provenance --access public

      - name: Setup node to publish to GitHub Packages
        uses: actions/setup-node@v7
        with:
          node-version: '24.x'
          registry-url: 'https://npm.pkg.github.com'
          scope: '@${{ github.repository_owner }}'

      - name: Publish to GitHub Packages
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GIT_AUTH_TOKEN }}
        run: |
          echo "//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}" > ~/.npmrc
          echo "@${{ github.repository_owner }}:registry=https://npm.pkg.github.com" >> ~/.npmrc
          npm publish