name: Publish

on:
  push:
    branches:
      - main
    paths:
      - 'package.json'
  workflow_dispatch:
    inputs:
      dry-run:
        description: 'Preview what would be published without actually publishing'
        required: false
        type: boolean
        default: true

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}

jobs:
  publish:
    name: Publish to npm
    runs-on: ubuntu-latest

    permissions:
      id-token: write
      contents: read

    env:
      FORCE_COLOR: 1
      CI: true
      NPM_CONFIG_PROVENANCE: true
      NPM_CONFIG_REGISTRY: 'https://registry.npmjs.org'

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24.18.0'
          registry-url: 'https://registry.npmjs.org'

      - name: Install Corepack
        run: npm install --global corepack@0.34.6
      - name: Enable corepack
        run: corepack enable

      - name: Install dependencies
        run: pnpm install --frozen-lockfile --prefer-offline

      - name: Determine whether to publish
        id: pub
        run: |
          name=$(jq -r .name package.json)
          version=$(jq -r .version package.json)
          if [ -n "$(npm view "$name@$version" version 2>/dev/null)" ]; then
            echo "$name@$version is already published; nothing to do"
            echo "publish=false" >> "$GITHUB_OUTPUT"
          else
            echo "queueing $name@$version"
            echo "publish=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Publish to npm
        if: steps.pub.outputs.publish == 'true'
        run: pnpm publish --no-git-checks ${{ (github.event.inputs['dry-run'] == 'true' && '--dry-run') || '' }}