name: Release Publish

# Publishes to npm when a release exists. This workflow file is the one bound
# to npm's Trusted Publisher — the same publish in release-please.yml 404s
# (observed 2026-09-15/16: v0.5.0 and v0.6.0 both failed from
# release-please.yml with "could not be found or you do not have permission",
# while release-publish.yml shipped 0.3.1/0.4.0/0.5.0 fine).
#
# Paths:
#  - workflow_run (Release Please completed): fires for GITHUB_TOKEN-created
#    events too, so bot-created releases publish automatically. The tag is
#    resolved as the latest published release (the one the post-merge
#    invocation just created).
#  - release: released: a manually-created release.
#  - workflow_dispatch: manual (re-)publish of an existing tag.
# An already-published guard skips no-op runs instead of failing on
# EPUBLISHCONFLICT.

on:
  release:
    types: [released]
  workflow_run:
    workflows: [Release Please]
    types: [completed]
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag to publish (e.g. v0.6.0)'
        required: true
        type: string

permissions:
  contents: read
  id-token: write # npm OIDC trusted publishing — no NPM_TOKEN secret required

concurrency:
  group: release
  cancel-in-progress: false # never kill a publish mid-flight (the v0.5.0-era cancel raced the PUT)

jobs:
  publish:
    if: >-
      github.event_name == 'release' ||
      github.event_name == 'workflow_dispatch' ||
      github.event.workflow_run.conclusion == 'success'
    runs-on: ubuntu-latest
    steps:
      - id: tag
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_TAG: ${{ github.event.release.tag_name || '' }}
          DISPATCH_TAG: ${{ inputs.tag || '' }}
        run: |
          # Values arrive via env (never interpolated into the script body —
          # zizmor template-injection).
          if [ -n "$RELEASE_TAG" ]; then
            echo "tag=$RELEASE_TAG" >> "$GITHUB_OUTPUT"
          elif [ -n "$DISPATCH_TAG" ]; then
            echo "tag=$DISPATCH_TAG" >> "$GITHUB_OUTPUT"
          else
            echo "tag=$(gh api "repos/$GITHUB_REPOSITORY/releases/latest" --jq .tag_name)" >> "$GITHUB_OUTPUT"
          fi
      - id: already
        env:
          TAG: ${{ steps.tag.outputs.tag }}
        run: |
          VERSION="${TAG#v}"
          if npm view "pi-codegraphcontext@$VERSION" version >/dev/null 2>&1; then
            echo "skip=true" >> "$GITHUB_OUTPUT"
          else
            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi
      - if: steps.already.outputs.skip != 'true'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ steps.tag.outputs.tag }}
      - if: steps.already.outputs.skip != 'true'
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          registry-url: 'https://registry.npmjs.org'
      - if: steps.already.outputs.skip != 'true'
        run: npm publish --access public --provenance