# - changesets will open a PR to bump versions when new changesets are added
# - changesets will publish packages when that PR is merged
# (it's confusing because the same action does two super different things)

name: Version or Publish Packages

on:
  workflow_dispatch:
  push:
    branches:
      - main

permissions:
  contents: read
  id-token: write

concurrency: ${{ github.workflow }}-${{ github.ref }}

env:
  CI: true
  PNPM_CACHE_FOLDER: .pnpm-store

jobs:
  publish:
    runs-on: ubuntu-latest
    environment:
      name: azure
      deployment: false
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 'lts/*'
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
      - run: pnpm config set store-dir $PNPM_CACHE_FOLDER
      - run: pnpm install
      - run: pnpm build
      - run: pnpm test
      - uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
        with:
          client-id: ${{ vars.AZURE_CLIENT_ID }}
          tenant-id: ${{ vars.AZURE_TENANT_ID }}
          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
      - name: Create GitHub App token
        id: app-token
        uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1
        with:
          client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }}
          key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }}
          owner: microsoft
          repositories: DefinitelyTyped-tools
          permission-contents: write
          permission-pull-requests: write
      - name: Configure git for GitHub App token
        shell: bash
        env:
          GITHUB_APP_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          set -euo pipefail
          basic_auth="$(node -e 'process.stdout.write(Buffer.from("x-access-token:" + process.env.GITHUB_APP_TOKEN).toString("base64"))')"
          echo "::add-mask::$basic_auth"
          git config --local http.https://github.com/.extraheader "AUTHORIZATION: basic ${basic_auth}"
      - name: Configure npm authentication
        run: printf '%s\n' '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' >> "$HOME/.npmrc"
      - uses: changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2
        with:
          github-token: ${{ steps.app-token.outputs.token }}
          publish-script: pnpm ci:publish
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}