name: Release

on:
  push:
    branches:
      - v[0-9]+.x

jobs:
  publish:
    runs-on: ubuntu-latest
    environment: npm
    permissions:
      id-token: write # Required for OIDC
      contents: read
    steps:
      - uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
        id: octo-sts
        with:
          scope: DataDog/pprof-format
          policy: self.github.release.push-tags
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          persist-credentials: false # drop GITHUB_TOKEN so the dd-octo-sts token is used for the tag push
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: '24'
          registry-url: 'https://registry.npmjs.org'
      - run: npm install
      - run: npm publish
      - id: pkg
        run: |
          content=`cat ./package.json | tr '\n' ' '`
          echo "json=$content" >> $GITHUB_OUTPUT
      - run: |
          git tag v${{ fromJson(steps.pkg.outputs.json).version }}
          git push https://x-access-token:${{ steps.octo-sts.outputs.token }}@github.com/${{ github.repository }}.git v${{ fromJson(steps.pkg.outputs.json).version }}