name: Release Please

on:
  push:
    branches: [master]

permissions: {}

jobs:
  release-please:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    outputs:
      release_created: ${{ steps.release.outputs.release_created }}
    steps:
      - uses: googleapis/release-please-action@v5
        id: release

  # Publishes to npm via OIDC trusted publishing: no token secret anywhere.
  # npm's registry trusts this exact repo + workflow file (configured in the
  # package's Trusted Publisher settings on npmjs.com) and mints short-lived
  # credentials from the id-token below. Requires npm >= 11.5.1.
  publish:
    needs: release-please
    if: ${{ needs.release-please.outputs.release_created == 'true' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: 26.x
          registry-url: https://registry.npmjs.org
      - run: npm publish