publish.yml

name: Publish

on:
  workflow_dispatch:
  push:
    tags:
      - "v*"

concurrency:
  group: publish-${{ github.ref }}
  cancel-in-progress: false

jobs:
  publish:
    name: Publish npm package
    runs-on: ubuntu-latest
    environment: npm-publish
    permissions:
      contents: read
      id-token: write
    env:
      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
      TURBO_TELEMETRY_DISABLED: "1"
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 22
          registry-url: https://registry.npmjs.org
          cache: npm

      - name: Upgrade npm for trusted publishing
        run: npm install --global npm@11.6.2

      - name: Restore Turbo local cache
        uses: actions/cache@v4
        with:
          path: .turbo
          key: ${{ runner.os }}-turbo-publish-${{ hashFiles('package-lock.json', 'turbo.json', 'tsconfig*.json', 'biome.json', 'src/**', 'scripts/**', '.github/workflows/**') }}
          restore-keys: |
            ${{ runner.os }}-turbo-publish-
            ${{ runner.os }}-turbo-

      - name: Install dependencies
        run: npm ci

      - name: Verify tag matches package version
        if: github.event_name == 'push'
        run: |
          set -euo pipefail

          PACKAGE_VERSION="$(node -p "require('./package.json').version")"
          TAG_VERSION="${GITHUB_REF_NAME#v}"

          if [ "$PACKAGE_VERSION" != "$TAG_VERSION" ]; then
            echo "Tag version $TAG_VERSION does not match package version $PACKAGE_VERSION"
            exit 1
          fi

      - name: Lint, typecheck, and build
        run: npx turbo run check:publish-safety lint typecheck build

      - name: Pack dry run
        run: npx turbo run pack:dry-run

      - name: Publish to npm
        run: npm publish