name: release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

permissions:
  contents: write
  id-token: write

jobs:
  release:
    runs-on: ubuntu-latest
    env:
      # Fallback only. Once a trusted publisher is configured on npmjs.com the
      # publish authenticates over OIDC and this secret can be deleted, along
      # with this line — a granular token cannot clear npm's 2FA challenge from
      # a non-interactive runner anyway.
      NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      # v6 is the first release that plumbs the OIDC id-token through to the
      # registry, which trusted publishing needs.
      - uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: pnpm
          registry-url: https://registry.npmjs.org
      - run: pnpm install --frozen-lockfile
      - run: pnpm run build
      - run: pnpm test
      - run: pnpm run test:singleton
      - name: Verify tag matches package.json version
        if: startsWith(github.ref, 'refs/tags/')
        run: |
          version="$(node -p 'require("./package.json").version')"
          if [ "refs/tags/v${version}" != "${GITHUB_REF}" ]; then
            echo "::error::tag ${GITHUB_REF#refs/tags/} does not match package.json version ${version}"
            exit 1
          fi
      # Node 22 ships npm 10, which predates OIDC support; trusted publishing
      # needs npm >= 11.5.1. Installed before packing so the Release asset and
      # the published tarball come out of the same packer and stay comparable.
      - name: Use an npm that supports trusted publishing
        run: npm install -g npm@latest
      - run: npm pack --pack-destination .
      - name: Stable tarball name for GitHub Releases
        run: |
          version="$(node -p 'require("./package.json").version')"
          cp "dsh-user-experience-${version}.tgz" dsh-user-experience.tgz
      - name: GitHub Release
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          generate_release_notes: true
          files: |
            dsh-user-experience.tgz
            dsh-user-experience-*.tgz
      # `pnpm publish` is deliberately not used here: pnpm 11 fails its OIDC
      # token exchange with a 404 and then falls back to the token, which
      # cannot clear npm's 2FA challenge from a non-interactive runner.
      # See https://github.com/pnpm/pnpm/issues/11513.
      #
      # Gated on tags only, and never on the presence of a token — a tag build
      # that cannot publish has to go red rather than quietly skip the step.
      - name: Publish to npm
        if: startsWith(github.ref, 'refs/tags/')
        run: npm publish --access public