name: Release

on:
  workflow_dispatch:

permissions: {}

jobs:
  build:
    name: Build
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Check out repo
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Log in to Azure
        uses: bitwarden/gh-actions/azure-login@main
        with:
          subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          tenant_id: ${{ secrets.AZURE_TENANT_ID }}
          client_id: ${{ secrets.AZURE_CLIENT_ID }}

      - name: Get Azure Key Vault secrets
        id: secrets
        uses: bitwarden/gh-actions/get-keyvault-secrets@main
        with:
          keyvault: ci-shared-kv
          secrets: "NPM-DEPLOY-TOKEN"

      - name: Log out from Azure
        uses: bitwarden/gh-actions/azure-logout@main

      - name: Build package
        run: npm ci && npm run build

  deploy:
    name: Deploy
    needs: build
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: Check out repo
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Publish to npm
        env:
          NODE_AUTH_TOKEN: ${{ steps.secrets.outputs.NPM-DEPLOY-TOKEN }}
        run: npm publish