copperhead

name: Release

# Publishes to npm when a v* tag is pushed, e.g.:
#   npm version minor && git push --follow-tags
# workflow_dispatch allows a manual run when a tag already exists.
on:
  push:
    tags: ['v*']
  workflow_dispatch:

permissions:
  contents: read

jobs:
  # Reuse the exact CI job rather than re-describing it here.
  test:
    uses: ./.github/workflows/ci.yml

  publish:
    needs: test
    runs-on: ubuntu-latest
    permissions:
      contents: read
      # OIDC token for npm trusted publishing (also what provenance signs with).
      id-token: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          # Node 22.14+ is required for trusted publishing; 24 also ships a
          # recent npm. registry-url writes the .npmrc that publish reads.
          node-version: 24
          cache: npm
          registry-url: https://registry.npmjs.org

      # Trusted publishing needs npm >= 11.5.1. Upgrade explicitly so the job
      # does not depend on whichever npm happens to ship with Node.
      - name: Ensure npm supports trusted publishing
        run: npm install -g npm@latest

      # Fail before doing any work if the version can't be published, so a bad
      # release costs seconds instead of a full KiCad-installing CI run.
      #
      # Note: versions at or below 0.2.1 are unusable. A previous owner of this
      # name unpublished in 2022 and npm tombstones those numbers permanently.
      # The registry stops advertising that list once a package has live
      # versions again, so it cannot be checked here: just never go backwards.
      - name: Preflight version check
        run: |
          VER="$(node -p "require('./package.json').version")"
          echo "package.json version: $VER"

          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
            TAG="${GITHUB_REF_NAME#v}"
            if [ "$TAG" != "$VER" ]; then
              echo "::error::Tag v$TAG does not match package.json version $VER"
              exit 1
            fi
          fi

          if npm view "copperhead@$VER" version > /dev/null 2>&1; then
            echo "::error::copperhead@$VER is already published. Bump the version."
            exit 1
          fi
          echo "$VER is free to publish"

      - run: npm ci
      - run: npm run build

      # No NPM_TOKEN: npm authenticates to the registry with the GitHub OIDC
      # token via trusted publishing (configured under the package's settings
      # on npmjs.com). Provenance is signed automatically from the same token.
      - run: npm publish