name: publish

on:
  release:
    types: [published]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read
  id-token: write

jobs:
  publish:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node 22
        uses: actions/setup-node@v6
        with:
          node-version: "22"
          registry-url: https://registry.npmjs.org
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Check
        run: npm run check

      - name: Unit tests
        run: npm test

      - name: Package smoke
        run: npm pack --dry-run

      - name: Publish to npm
        run: |
          if [ -z "$NODE_AUTH_TOKEN" ]; then
            echo "NODE_AUTH_TOKEN is not configured; skipping npm publish."
            exit 0
          fi
          npm publish --access public --provenance
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }}