name: Publish

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: Existing v-prefixed tag to publish
        required: true
        type: string

permissions:
  contents: read
  id-token: write

concurrency:
  group: npm-publish
  cancel-in-progress: false

jobs:
  publish:
    name: Publish to npm
    runs-on: ubuntu-24.04
    environment: npm-publish
    env:
      RELEASE_TAG: ${{ github.event.release.tag_name || inputs.tag }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ env.RELEASE_TAG }}
          fetch-depth: 0
          persist-credentials: false

      - uses: pnpm/setup@v2
        with:
          install: false

      - uses: actions/setup-node@v7
        with:
          node-version: '24'
          package-manager-cache: false

      - name: Install npm with trusted-publishing support
        run: npm install --global 'npm@^11.5.1'

      - name: Verify tag and package version
        run: |
          node -e 'const metadata = require("./package.json"); const expected = "v" + metadata.version; if (process.env.RELEASE_TAG !== expected) throw new Error("release tag " + process.env.RELEASE_TAG + " does not match package version " + expected)'
          tagged_commit=$(git rev-list -n 1 "$RELEASE_TAG")
          checked_out_commit=$(git rev-parse HEAD)
          if test "$tagged_commit" != "$checked_out_commit"; then
            echo "checked out $checked_out_commit instead of $tagged_commit for $RELEASE_TAG" >&2
            exit 1
          fi

      - run: pnpm install --frozen-lockfile
      - run: pnpm run check

      - name: Pack the verified package
        run: pnpm pack --pack-destination .artifacts

      - name: Publish the verified archive
        run: |
          package_version=$(node -p 'require("./package.json").version')
          package_archive=".artifacts/benz-ai-x-dsh-client-ui-session-graph-$package_version.tgz"
          publish_tag=$(node -p 'require("./package.json").version.includes("-") ? "next" : "latest"')
          npm publish "$package_archive" --access public --provenance --tag "$publish_tag" --loglevel verbose