name: Release

on:
  push:
    tags: ['v*']

permissions:
  contents: read
  id-token: write # npm provenance / trusted publishing

jobs:
  publish:
    runs-on: ubuntu-latest
    environment: release # must match the npm Trusted Publisher config
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: pnpm
          registry-url: https://registry.npmjs.org
      - run: pnpm install --frozen-lockfile
      # Skip if this version is already on the registry (idempotent re-runs)
      - name: Check version not already published
        id: check
        run: |
          NAME=$(node -p "require('./package.json').name")
          VERSION=$(node -p "require('./package.json').version")
          if npm view "$NAME@$VERSION" version >/dev/null 2>&1; then
            echo "skip=true" >> "$GITHUB_OUTPUT"
            echo "$NAME@$VERSION already published - skipping"
          else
            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi
      # prepublishOnly runs typecheck + tests + build as the gate
      # Auth via npm Trusted Publisher (OIDC) - no token needed.
      # Requires npm >= 11.5; Node 22 ships older, so upgrade npm first.
      - if: steps.check.outputs.skip == 'false'
        run: |
          npm install -g npm@latest
          npm publish --access public --provenance