name: Publish to npm

on:
  push:
    tags:
      - "v*"

permissions:
  id-token: write # OIDC 认证必需
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-node@v7
        with:
          node-version: "26"
          registry-url: "https://registry.npmjs.org"

      - run: npm install -g npm@latest # OIDC 需要 npm >= 11.5.1

      - run: npm install

      - run: npm run check
      - run: npm run lint
      - run: npm test

      # OIDC Trusted Publishing（npm 2025-12 起 classic token 已吊销，
      # 2026 官方推荐路径）。注意：不要设置 NODE_AUTH_TOKEN——
      # 空 token 会遮蔽 OIDC 认证。需先在 npmjs.com 配置 Trusted Publisher。
      - run: npm publish --provenance --access public