release.yml

name: Release

# Publishes @diceforge-sdk/core, @diceforge-sdk/renderer-web,
# @diceforge-sdk/assets-forge, @diceforge-sdk/testing and
# @diceforge-sdk/presenter-physics when a version tag (v*) is pushed. Every package
# releases together at the same version (ADR-0009). Authentication uses npm
# trusted publishing (GitHub OIDC), which must be configured in each package's
# npmjs.com settings; provenance links the published artifacts to this workflow
# run. A package's very first publish still happens from a maintainer machine,
# because npm has nothing to attach a trusted publisher to until it exists.

on:
  push:
    tags: ["v*"]

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v5
        with:
          node-version: 24
          cache: npm
          registry-url: https://registry.npmjs.org
      - run: npm ci
      - run: npm run check
      - run: npm run typecheck
      - run: npm run test:coverage
      - run: npm run build
      - name: Verify tag matches package versions
        run: |
          TAG="${GITHUB_REF_NAME#v}"
          for PKG in packages/core packages/renderer-web packages/assets-forge packages/testing packages/presenter-physics; do
            VERSION=$(node -p "require('./$PKG/package.json').version")
            if [ "$VERSION" != "$TAG" ]; then
              echo "::error::$PKG is $VERSION but tag is $TAG"; exit 1
            fi
          done
      - name: Publish packages (idempotent per version)
        run: |
          set -e
          for DIR in packages/core packages/renderer-web packages/assets-forge packages/testing packages/presenter-physics; do
            NAME=$(node -p "require('./$DIR/package.json').name")
            VERSION=$(node -p "require('./$DIR/package.json').version")
            # A fast path, not the authority. `npm view` reads a cached
            # packument and can lag minutes behind a publish that just
            # happened, so a miss here does not prove the version is absent —
            # which is exactly how v0.5.0 failed, having been published by hand
            # moments before the tag.
            if npm view "$NAME@$VERSION" version >/dev/null 2>&1; then
              echo "$NAME@$VERSION already on the registry - skipping"
              continue
            fi
            # The registry is the authority. Refusing to overwrite a version is
            # it telling us the version is already there, which is the state
            # this step exists to reach. Every other failure is real.
            # Redirected rather than piped: a pipeline reports the last
            # command's status, which would hide npm's.
            if npm publish --workspace "$NAME" --provenance --access public >publish.log 2>&1; then
              cat publish.log
              echo "published $NAME@$VERSION"
            elif grep -q "cannot publish over the previously published versions" publish.log; then
              echo "$NAME@$VERSION was already published - nothing to do"
            else
              cat publish.log >&2
              exit 1
            fi
          done