name: Publish to npm

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: Existing release tag, e.g. v0.4.0
        required: true
        type: string

permissions:
  contents: read

concurrency:
  group: npm-${{ github.event.release.tag_name || inputs.tag }}
  cancel-in-progress: false

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
    env:
      RELEASE_TAG: ${{ github.event.release.tag_name || inputs.tag }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ env.RELEASE_TAG }}

      - uses: actions/setup-node@v4
        with:
          node-version: '24'
          registry-url: https://registry.npmjs.org

      - name: Use npm with Trusted Publishing support
        run: npm install --global npm@11.19.0

      - name: Validate release version
        run: node scripts/check-release-version.mjs

      - name: Install dependencies
        run: npm ci --ignore-scripts

      - name: Unit tests
        run: npm test

      - name: Package checks
        run: npm run check

      - name: Theme generator sanity
        run: |
          python3 tools/make_theme.py --output /tmp/theme.lottie
          python3 -c "import zipfile,json; z=zipfile.ZipFile('/tmp/theme.lottie'); assert json.loads(z.read('cua/theme.json'))['id']=='com.dsh.computeruse.rainbow'; print('theme OK')"

      - name: Pack only distributable files
        run: npm pack --ignore-scripts

      - name: Attach package to GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release upload "$RELEASE_TAG" ./dsh-computer-use-ng-*.tgz --clobber

      - name: Publish using npm Trusted Publishing
        run: npm publish ./dsh-computer-use-ng-*.tgz --access public --provenance --ignore-scripts --tag "$NPM_TAG"