name: Release

# Fires on a version tag (npm version's own default tag shape, "v0.1.0"
# etc.) -- the one trigger for an actual publish. Nothing here runs on
# a normal push/PR; see ci.yml for that. Cutting a release is manual on
# purpose (see app/RELEASING.md): `npm version <bump>` + `git push
# --follow-tags` from app/, then this takes over.
on:
  push:
    tags:
      - "v*"

permissions:
  contents: write # to create the GitHub Release
  id-token: write # for npm provenance (--provenance)

jobs:
  release:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: app
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          registry-url: "https://registry.npmjs.org"
          cache: npm
          cache-dependency-path: app/package-lock.json

      - run: npm ci

      # The tag is the one source of truth for "what version is this
      # release" -- fail loudly if package.json disagrees, rather than
      # silently publishing whatever the tag says over whatever
      # package.json says (or vice versa). A mistagged release is a
      # mistake worth stopping for, not working around.
      - name: Verify tag matches package.json version
        run: |
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          PKG_VERSION="$(node -p "require('./package.json').version")"
          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
            echo "::error::tag ${GITHUB_REF_NAME} does not match package.json version ${PKG_VERSION}"
            exit 1
          fi

      # The full dev-time typecheck (covers demo/demo-repos too, same
      # as this project's own verify-before-deploy discipline
      # elsewhere), not just the published subset -- a release is
      # exactly the moment to run the stricter check.
      - run: npx tsc --noEmit -p .

      - run: npm run build

      - run: npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release create "${GITHUB_REF_NAME}" --title "${GITHUB_REF_NAME}" --generate-notes