name: Publish to npm

on:
  release:
    types:
      - published

permissions:
  contents: read
  id-token: write

concurrency:
  group: npm-publish
  cancel-in-progress: false

jobs:
  publish:
    name: Publish release
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Check out release
        uses: actions/checkout@v7

      - name: Install pnpm
        uses: pnpm/action-setup@v6

      - name: Set up Node.js and npm registry
        uses: actions/setup-node@v7
        with:
          node-version: 24.10.0
          registry-url: https://registry.npmjs.org
          package-manager-cache: false

      - name: Verify release tag matches package version
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          PACKAGE_VERSION="$(node -p "require('./package.json').version")"
          if [ "$RELEASE_TAG" != "v$PACKAGE_VERSION" ]; then
            echo "Release tag $RELEASE_TAG does not match package version v$PACKAGE_VERSION."
            exit 1
          fi

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Publish package
        run: npm publish --access public