name: Publish to npm

on:
  workflow_dispatch:
    inputs:
      dry-run:
        description: 'Simulate the publish without uploading to npm or creating a GitHub release'
        type: boolean
        default: false

permissions: {}

concurrency:
  group: publish
  cancel-in-progress: false

jobs:
  publish:
    name: Publish to npm and create GitHub release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write

    steps:
      - name: Checkout
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
        with:
          persist-credentials: false

      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          registry-url: 'https://registry.npmjs.org'
          cache: npm

      - name: Verify branch is main
        run: |
          if [[ "$GITHUB_REF" != "refs/heads/main" ]]; then
            echo "::error::Publish must be run from main, got $GITHUB_REF"
            exit 1
          fi

      - name: Log npm version
        run: npm -v

      - name: Read version from package.json
        id: pkg
        run: |
          VERSION=$(node -p "require('./package.json').version")
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "tag=v$VERSION" >> "$GITHUB_OUTPUT"

      - name: Fail if tag or release already exists
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ steps.pkg.outputs.tag }}
        run: |
          if git ls-remote --exit-code --tags origin "refs/tags/$TAG" >/dev/null 2>&1; then
            echo "::error::Tag $TAG already exists on origin"
            exit 1
          fi
          if gh release view "$TAG" >/dev/null 2>&1; then
            echo "::error::GitHub release $TAG already exists"
            exit 1
          fi

      - name: Extract release notes from CHANGELOG.md
        env:
          VERSION: ${{ steps.pkg.outputs.version }}
        run: |
          awk -v ver="$VERSION" '
            $0 ~ "^## " ver "( |$)" { found=1; next }
            found && /^## / { exit }
            found { print }
          ' CHANGELOG.md > release_notes.md
          if ! grep -q '[^[:space:]]' release_notes.md; then
            echo "::error::No release notes found in CHANGELOG.md for version $VERSION"
            exit 1
          fi

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run build

      - name: Lint
        run: npm run lint

      - name: Test
        run: npm test

      - name: Create git tag and GitHub release
        if: ${{ !inputs.dry-run }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ steps.pkg.outputs.tag }}
          VERSION: ${{ steps.pkg.outputs.version }}
        run: |
          gh release create "$TAG" \
            --title "$VERSION" \
            --notes-file release_notes.md \
            --target "$GITHUB_SHA"

      - name: Publish to npm (Trusted Publishing + provenance)
        env:
          DRY_RUN_FLAG: ${{ inputs.dry-run && '--dry-run' || '' }}
        run: npm publish --provenance --access public $DRY_RUN_FLAG

      - name: Dry-run summary (no tag or release created)
        if: ${{ inputs.dry-run }}
        env:
          TAG: ${{ steps.pkg.outputs.tag }}
          VERSION: ${{ steps.pkg.outputs.version }}
        run: |
          echo "Dry run complete — no tag pushed, no GitHub release created."
          echo "Would have created tag:    $TAG"
          echo "Would have created release: $VERSION"
          echo "Release notes that would have been used:"
          echo "----"
          cat release_notes.md
          echo "----"