release.yml

name: Release

on:
  push:
    tags: ["v*"]

permissions:
  contents: write # create the GitHub release + upload archives

jobs:
  goreleaser:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # goreleaser needs full history for the changelog

      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true


      # A flake building `src = self` has no git tag to read, so flake.nix
      # carries the version as a literal. Fail the release rather than ship a
      # binary that reports the wrong version to nix users.
      - name: flake.nix version matches the tag
        run: |
          tag="${GITHUB_REF_NAME#v}"
          flake=$(sed -n 's/^ *version = "\(.*\)";$/\1/p' flake.nix)
          if [ "$tag" != "$flake" ]; then
            echo "::error::tag $tag does not match flake.nix version $flake"
            exit 1
          fi

      - uses: goreleaser/goreleaser-action@v6
        with:
          version: "~> v2"
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Needed only for the Homebrew cask push. Create a `homebrew-tap` repo
          # and a PAT with `repo` scope on it, saved as this secret. Without it,
          # add `--skip=homebrew` to args above to release binaries only.
          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}

  # Publishes @sanketsudake/chrome-cdp via TRUSTED PUBLISHING (OIDC): npm
  # verifies this workflow's GitHub identity instead of accepting a long-lived
  # token. That needs a one-time setup on npmjs.com — package Settings ->
  # Trusted Publisher, all fields case-sensitive and exact:
  #
  #   Organization or user: sanketsudake
  #   Repository:           chrome-cdp-cli
  #   Workflow filename:    release.yml      (filename only, no path)
  #   Allowed actions:      npm publish
  #
  # Renaming this file, the repo, or the owner breaks publishing until the
  # trusted publisher is updated to match.
  #
  # Why bother: npm is retiring 2FA-bypass granular access tokens for direct
  # publishing (phase 2, ~January 2027), and OIDC removes the standing
  # publish credential from the repo altogether.
  npm:
    needs: goreleaser
    runs-on: ubuntu-latest
    # Gated on a repository variable so a fork — which cannot satisfy this
    # package's trusted publisher — skips the publish instead of failing the
    # whole release. Set the NPM_PUBLISH repository variable to "true" to arm
    # it.
    if: vars.NPM_PUBLISH == 'true'
    permissions:
      contents: read
      # Required for OIDC: this is what lets npm verify the workflow identity.
      id-token: write
    steps:
      - uses: actions/checkout@v4

      # Trusted publishing needs Node >= 22.14.0 AND npm >= 11.5.1. Node 24
      # satisfies the runtime floor, but the bundled npm varies by patch
      # release, so the CLI is pinned explicitly below rather than assumed:
      # an npm too old to speak OIDC looks for a token instead, and with no
      # token configured that surfaces as an authentication failure rather
      # than anything that names the real cause.
      - uses: actions/setup-node@v4
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org

      - name: Ensure an npm that supports trusted publishing
        run: |
          npm install -g npm@^11.5.1
          echo "npm $(npm --version) / node $(node --version)"

      # No NODE_AUTH_TOKEN: the NPM_TOKEN secret is deleted and OIDC is the
      # only authentication path. That is the point of trusted publishing —
      # the repo holds no standing publish credential — and it means a
      # misconfigured trusted publisher fails the publish outright instead of
      # quietly falling back to a token, which is the louder of the two
      # failure modes and the one we want.
      #
      # --provenance is redundant under trusted publishing (attestations are
      # generated automatically) and kept only because it states the intent
      # at the call site; dropping it would not change what is published.
      - run: cd npm && npm version "${GITHUB_REF_NAME#v}" --no-git-tag-version && npm test && npm publish --provenance --access public