Test release

.github/workflows/ci.yml

@@ -0,0 +1,53 @@
+name: CI
+
+on:
+  pull_request:
+    branches:
+      - main
+      - dev
+
+jobs:
+  test:
+    name: Test (Node ${{ matrix.node-version }})
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        node-version: ["20"]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Configure git for tests
+        run: |
+          git config --global user.email "ci@foreman.dev"
+          git config --global user.name "Foreman CI"
+          git config --global init.defaultBranch main
+
+      - name: Set up Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+
+      - name: Cache node_modules
+        id: cache-node-modules
+        uses: actions/cache@v4
+        with:
+          path: node_modules
+          key: npm-${{ runner.os }}-${{ matrix.node-version }}-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            npm-${{ runner.os }}-${{ matrix.node-version }}-
+            npm-${{ runner.os }}-
+
+      - name: Install dependencies
+        if: steps.cache-node-modules.outputs.cache-hit != 'true'
+        run: npm ci
+
+      - name: Type check
+        run: npx tsc --noEmit
+
+      - name: Run tests
+        run: npm test

.github/workflows/publish-npm.yml

@@ -0,0 +1,123 @@
+name: Publish to npm
+
+# Trigger on version tag push (e.g. v1.2.3) or manual dispatch
+on:
+  push:
+    tags:
+      - "v*.*.*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag name to publish (e.g. v1.2.3)"
+        required: true
+        type: string
+      dry_run:
+        description: "Dry run — build and pack but do not publish to npm"
+        required: false
+        default: "false"
+        type: choice
+        options:
+          - "false"
+          - "true"
+
+# Minimal permissions — read-only source; npm publish uses NPM_TOKEN (not GITHUB_TOKEN)
+permissions:
+  contents: read
+
+jobs:
+  publish-npm:
+    name: Publish @oftheangels/foreman to npm
+    runs-on: ubuntu-latest
+
+    steps:
+      # ── Checkout ─────────────────────────────────────────────────────────────
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      # ── Node.js setup with npm authentication ────────────────────────────────
+      # setup-node@v4 writes an .npmrc that injects NPM_TOKEN automatically
+      # when registry-url is provided.
+      - name: Set up Node.js 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          registry-url: "https://registry.npmjs.org"
+          scope: "@oftheangels"
+
+      # ── Dependency cache ──────────────────────────────────────────────────────
+      - name: Cache node_modules
+        id: cache-node-modules
+        uses: actions/cache@v4
+        with:
+          path: node_modules
+          key: npm-${{ runner.os }}-20-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            npm-${{ runner.os }}-20-
+
+      - name: Install dependencies
+        if: steps.cache-node-modules.outputs.cache-hit != 'true'
+        run: npm ci
+
+      # ── Determine release tag ─────────────────────────────────────────────────
+      - name: Determine release tag
+        id: tag
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "tag=${{ github.event.inputs.tag }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "tag=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
+          fi
+
+      # ── Version consistency check ─────────────────────────────────────────────
+      # Guard against publishing when the git tag version does not match
+      # the version declared in package.json (e.g. forgot to bump).
+      - name: Verify git tag matches package.json version
+        run: |
+          TAG="${{ steps.tag.outputs.tag }}"
+          PKG_VERSION="v$(node -p "require('./package.json').version")"
+
+          echo "Git tag:          $TAG"
+          echo "package.json:     $PKG_VERSION"
+
+          if [ "$TAG" != "$PKG_VERSION" ]; then
+            echo "ERROR: Git tag ($TAG) does not match package.json version ($PKG_VERSION)."
+            echo "  1. Update version in package.json to match the tag, OR"
+            echo "  2. Push a new tag that matches the current package.json version."
+            exit 1
+          fi
+
+          echo "Version check passed: $TAG == $PKG_VERSION"
+
+      # ── TypeScript type check ─────────────────────────────────────────────────
+      - name: Type check (tsc --noEmit)
+        run: npx tsc --noEmit
+
+      # ── Run tests ─────────────────────────────────────────────────────────────
+      - name: Run test suite
+        run: npm test
+
+      # ── TypeScript build ───────────────────────────────────────────────────────
+      - name: Build (TypeScript → dist/)
+        run: npm run build
+
+      # ── Dry-run: pack only ────────────────────────────────────────────────────
+      - name: Pack (dry run — inspect tarball without publishing)
+        if: ${{ github.event.inputs.dry_run == 'true' }}
+        run: |
+          npm pack --dry-run
+          echo "DRY RUN — package would be published as above. No npm publish executed."
+
+      # ── Publish to npm ────────────────────────────────────────────────────────
+      - name: Publish to npm registry
+        if: ${{ github.event.inputs.dry_run != 'true' }}
+        run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      # ── Summary ───────────────────────────────────────────────────────────────
+      - name: Publish summary
+        if: ${{ github.event.inputs.dry_run != 'true' }}
+        run: |
+          TAG="${{ steps.tag.outputs.tag }}"
+          PKG_NAME=$(node -p "require('./package.json').name")
+          echo "✅ Published ${PKG_NAME}@${TAG#v} to https://www.npmjs.com/package/${PKG_NAME}"