publish.yml

name: Publish
on:
  pull_request:
    types: [closed]
    branches: [master]

permissions:
  contents: read

jobs:
  publish:
    if: >-
      github.event.pull_request.merged == true &&
      github.event.pull_request.head.repo.full_name == github.repository &&
      startsWith(github.event.pull_request.head.ref, 'release-v')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.merge_commit_sha }}
      - uses: actions/setup-node@v7
        with:
          node-version: '24.x'
          registry-url: 'https://registry.npmjs.org'
          cache: npm
      - name: Resolve release version
        id: release
        env:
          RELEASE_BRANCH: ${{ github.event.pull_request.head.ref }}
        run: |
          node --input-type=module <<'NODE'
          import { appendFileSync, readFileSync } from 'node:fs';
          const { version } = JSON.parse(readFileSync('package.json', 'utf8'));
          if (!/^\d+\.\d+\.\d+(?:-rc\.\d+)?$/.test(version) ||
              process.env.RELEASE_BRANCH !== `release-v${version}`) {
            throw new Error('The release branch must match the stable or RC version in package.json.');
          }
          const tag = version.includes('-rc.') ? 'rc' : 'latest';
          appendFileSync(process.env.GITHUB_OUTPUT, `tag=${tag}\n`);
          NODE
      - run: npm ci
      - run: npm run lint
      - run: npm run typecheck
      - run: npm test -- --runInBand --ci
      - run: npm run build
      - run: npm run test:bundle -- --ci
      - name: Publish to npm
        run: npm publish --access public --tag "$NPM_TAG"
        env:
          NPM_TAG: ${{ steps.release.outputs.tag }}
          NODE_AUTH_TOKEN: ${{ secrets.ORG_NPM_TOKEN }}