release.yml

name: release

# Publishes @sx4im/skillcheck to npm with provenance when a version tag is pushed:
#
#   npm version patch        # bumps package.json + creates the tag
#   git push --follow-tags
#
# Requires an NPM_TOKEN secret (an npm automation token). The job refuses to
# publish unless the tag matches the version in package.json, so a mistyped tag
# can't ship the wrong version.
on:
  push:
    tags:
      - 'v*.*.*'

permissions:
  contents: read
  id-token: write # required for npm provenance

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: npm
          registry-url: 'https://registry.npmjs.org'

      - run: npm ci

      - name: Verify the tag matches package.json
        run: |
          set -euo pipefail
          tag="${GITHUB_REF_NAME#v}"
          pkg="$(node -p "require('./package.json').version")"
          if [ "$tag" != "$pkg" ]; then
            echo "::error::Tag v$tag does not match package.json version $pkg"
            exit 1
          fi

      - run: npm run lint
      - run: npm run typecheck
      - run: npm run build
      - run: npm run test:coverage

      - name: Check NPM_TOKEN secret
        id: check_token
        run: |
          if [ -z "${NODE_AUTH_TOKEN:-}" ]; then
            echo "::warning::NPM_TOKEN secret is not set in GitHub repository secrets. Skipping automated npm publish step."
            echo "skip=true" >> "$GITHUB_OUTPUT"
          else
            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Publish to npm (with provenance)
        if: steps.check_token.outputs.skip != 'true'
        run: npm publish --provenance --access public || echo "Notice: Package already published or skipped."
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}