publish.yml

name: Publish
on:
  release:
    types: [published]
  workflow_dispatch:
permissions:
  contents: read

jobs:
  publish:
    name: Publish to npm
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write # required for npm provenance
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 20
          cache: npm
          registry-url: https://registry.npmjs.org
      - name: Install dependencies
        run: npm ci --ignore-scripts
      - name: Build
        run: npm run build
      - name: Assert iife bundle exists
        run: test -s lib/index.iife.min.js
      - name: Verify package version matches release tag
        if: github.event_name == 'release'
        run: |
          PKG_VERSION=$(node -p "require('./package.json').version")
          TAG=${GITHUB_REF_NAME#v}
          if [ "$PKG_VERSION" != "$TAG" ]; then
            echo "package.json version ($PKG_VERSION) does not match release tag ($TAG)"
            exit 1
          fi
      - name: Publish
        run: npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}