name: Publish @avensio/shared

on:
  push:
    tags: ['v*']

concurrency:
  group: publish-shared-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read
  id-token: write

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout tagged commit
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Verify tag version and main ancestry
        run: |
          expected_tag="v$(node -p "require('./package.json').version")"
          test "$GITHUB_REF_NAME" = "$expected_tag" || {
            echo "Tag $GITHUB_REF_NAME does not match package version $expected_tag" >&2
            exit 1
          }
          git fetch --no-tags origin main:refs/remotes/origin/main
          git merge-base --is-ancestor "$GITHUB_SHA" origin/main || {
            echo "Tagged commit is not contained in main" >&2
            exit 1
          }

      - uses: pnpm/action-setup@v4
        with:
          version: 10.20.0

      - uses: actions/setup-node@v6
        with:
          node-version: 24
          package-manager-cache: false
          registry-url: https://registry.npmjs.org

      - name: Install dependencies
        run: pnpm install --no-frozen-lockfile

      - name: Lint
        run: pnpm lint

      - name: Build package
        run: pnpm build

      - name: Test
        run: pnpm test

      - name: Publish to npm
        run: npm publish --access public --ignore-scripts