name: Publish to npm

on:
  push:
    tags:
      - 'v*'
  # Allow manual re-runs of a failed publish.
  workflow_dispatch:

permissions:
  contents: read
  id-token: write

jobs:
  publish:
    name: Build and publish
    runs-on: ubuntu-latest
    # Never publish from a fork.
    if: github.repository_owner == 'heartmove'

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 11.21.0
          run_install: false

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 22
          registry-url: https://registry.npmjs.org
          cache: pnpm

      # The lockfile and exact dev dependencies target DSH 0.2.2-alpha.3; the
      # declared support window is the open range >=0.2.1-rc.1 (the floor line is
      # re-verified against 0.2.1-rc.1 for every version-line move).
      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Typecheck
        run: pnpm typecheck

      - name: Test
        run: pnpm test

      - name: Build
        run: pnpm build

      - name: Resolve package version (tag → package.json)
        id: version
        shell: bash
        run: |
          if [[ "${{ github.ref }}" == refs/tags/* ]]; then
            # Tag push (vX.Y.Z): use the tag name, stripping the leading v.
            echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
          else
            # Manual dispatch (no tag): publish the version already in package.json.
            echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT"
          fi

      - name: Sync version
        run: |
          node -e "
            const fs=require('fs');
            const tag='${{ steps.version.outputs.version }}';
            const p=JSON.parse(fs.readFileSync('package.json','utf8'));
            const m=JSON.parse(fs.readFileSync('dsh.plugin.json','utf8'));
            p.version=tag; m.version=tag;
            fs.writeFileSync('package.json',JSON.stringify(p,null,2)+'\n');
            fs.writeFileSync('dsh.plugin.json',JSON.stringify(m,null,2)+'\n');
          "

      # A prerelease must never land on `latest`, or it would displace the
      # stable line for every `dsh-side-chat-plus` consumer. `0.4.0-alpha.1`
      # publishes under `alpha`; a plain `0.4.0` publishes under `latest`.
      - name: Resolve npm dist-tag
        id: disttag
        run: |
          node -e "
            const version = '${{ steps.version.outputs.version }}';
            const prerelease = version.split('+')[0].split('-')[1];
            const tag = prerelease ? prerelease.split('.')[0] : 'latest';
            require('fs').appendFileSync(process.env.GITHUB_OUTPUT, 'tag=' + tag + '\n');
            console.log('publishing ' + version + ' under dist-tag \'' + tag + '\'');
          "

      - name: Publish to npm
        run: pnpm publish --no-git-checks --access public --provenance --tag "${{ steps.disttag.outputs.tag }}"
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}