name: Publish to npm

on:
  release:
    types: [published]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm
      - run: npm ci
      - run: npm run build
      - run: npm run prettier

  test:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm
      - run: npm ci
      - run: npm test

  publish:
    runs-on: ubuntu-latest
    if: github.event_name == 'release'
    environment: Release
    needs: [build, test]

    permissions:
      contents: read
      id-token: write

    steps:
      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm
          registry-url: "https://registry.npmjs.org"
      - run: npm ci

      - name: Determine npm tag
        id: npm-tag
        run: |
          VERSION=$(node -p "require('./package.json').version")
          # Check if this is a beta release
          if [[ "$VERSION" == *"-beta"* ]]; then
            echo "tag=--tag beta" >> $GITHUB_OUTPUT
          # Check if this release is from a non-main branch (patch/maintenance release)
          elif [[ "${{ github.event.release.target_commitish }}" != "main" ]]; then
            # Use "release-X.Y" as tag for old branch releases
            MAJOR_MINOR=$(echo "$VERSION" | cut -d. -f1,2)
            echo "tag=--tag release-${MAJOR_MINOR}" >> $GITHUB_OUTPUT
          else
            echo "tag=" >> $GITHUB_OUTPUT
          fi

      - run: npm publish --provenance --access public ${{ steps.npm-tag.outputs.tag }}
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_SECRET }}