release.yml

name: Release

# Trigger on manual workflow dispatch or version tags
on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'npm dist-tag to publish under (e.g., latest, beta, next)'
        required: false
        default: 'beta'
      dry_run:
        description: 'Dry run (npm publish --dry-run)'
        required: false
        type: boolean
        default: false
  push:
    tags:
      - 'v*.*.*'

permissions:
  id-token: write  # Required for OIDC
  contents: read

jobs:
  validate:
    name: Validate Build
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Enable Corepack
        run: corepack enable

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Compile
        run: pnpm run compile

      - name: Lint
        run: pnpm run lint

      - name: Build
        run: pnpm run build

      - name: Verify type definitions
        run: |
          if [ ! -f "dist/index.d.ts" ]; then
            echo "Error: Type definitions not generated"
            exit 1
          fi
          echo "Type definitions verified: $(wc -l < dist/index.d.ts) lines"

      - name: Verify CLI executable
        run: |
          if [ ! -f "dist/cli.js" ]; then
            echo "Error: CLI executable not found"
            exit 1
          fi
          if ! head -n 1 dist/cli.js | grep -q "#!/usr/bin/env node"; then
            echo "Error: CLI missing shebang"
            exit 1
          fi
          echo "CLI executable verified"

      - name: Test
        run: pnpm run test

      - name: Upload dist artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/
          retention-days: 7

  publish:
    name: Publish to npm
    runs-on: ubuntu-latest

    permissions:
      id-token: write  # Required for OIDC
      contents: read

    needs: validate
    if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Configure npm for user-specific global installs
        run: |
          npm config set prefix ~/.npm-global
          echo "~/.npm-global/bin" >> $GITHUB_PATH
        shell: bash

      - name: Update npm to the latest version (now in a user-owned directory)
        run: npm install -g npm@latest

      - name: Verify the new npm version (optional)
        run: npm -v
        
      - name: Enable Corepack
        run: corepack enable

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'
          registry-url: 'https://registry.npmjs.org'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build
        run: pnpm run build

      - name: Publish to npm (workflow_dispatch)
        if: github.event_name == 'workflow_dispatch'
        run: |
          if [ "${{ github.event.inputs.dry_run }}" == "true" ]; then
            echo "Dry run mode - would publish with tag: ${{ github.event.inputs.tag }}"
            npm publish --dry-run --tag ${{ github.event.inputs.tag }}
          else
            npm publish --tag ${{ github.event.inputs.tag }}
          fi
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Publish to npm (tag push)
        if: startsWith(github.ref, 'refs/tags/v')
        run: npm publish --tag latest
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}