release.yml

name: Publish to npm

on:
  release:
    types: [published]

permissions:
  contents: read
  id-token: write

concurrency:
  group: release-${{ github.event.release.tag_name }}
  cancel-in-progress: false

jobs:
  publish:
    runs-on: ubuntu-latest
    environment: npm-publish
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.release.tag_name }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          registry-url: 'https://registry.npmjs.org'

      - name: Upgrade npm
        run: npm install -g npm@11.5.1

      - name: Verify version matches tag
        run: |
          TAG='${{ github.event.release.tag_name }}'
          TAG_VERSION="${TAG#v}"
          PKG_VERSION=$(node -p "require('./package.json').version")
          if [[ "$TAG_VERSION" != "$PKG_VERSION" ]]; then
            echo "::error::Tag version ($TAG_VERSION) does not match package.json version ($PKG_VERSION)"
            exit 1
          fi
          echo "VERSION=$TAG_VERSION" >> "$GITHUB_ENV"
          if [[ "${{ github.event.release.prerelease }}" == "true" ]]; then
            echo "DIST_TAG=next" >> "$GITHUB_ENV"
          else
            echo "DIST_TAG=latest" >> "$GITHUB_ENV"
          fi

      - name: Publish to npm
        run: npm publish --access public --tag "$DIST_TAG" --provenance
        env:
          NPM_CONFIG_PROVENANCE: true

      - name: Summary
        run: |
          {
            echo "### Published ${{ github.event.release.tag_name }}"
            echo ""
            echo "- Version: \`$VERSION\`"
            echo "- npm dist-tag: \`$DIST_TAG\`"
          } >> "$GITHUB_STEP_SUMMARY"