release-npm.yml

name: Release npm - Publish npm Package

on:
  workflow_call:
    inputs:
      version:
        description: 'Release version tag (e.g., vX.Y.Z or vX.Y.Z-PRERELEASE). Must match ^vMAJOR.MINOR.PATCH(-PRERELEASE)?$ where PRERELEASE may contain alphanumerics, dots, and hyphens.'
        required: true
        type: string
    outputs:
      release_name:
        description: 'The release name without "v" prefix (e.g., X.Y.Z)'
        value: ${{ jobs.publish-npm.outputs.release_name }}
      version:
        description: 'The full version string with "v" prefix (e.g., vX.Y.Z)'
        value: ${{ jobs.publish-npm.outputs.version }}

# Note: This workflow is called exclusively via workflow_call from release.yml.
# It does NOT have a workflow_dispatch trigger because npm Trusted Publishing
# validates the *calling* workflow filename for OIDC. The trusted publisher on
# npmjs.com is configured with workflow "release.yml" and environment
# "release-npm". Direct dispatch would present "release-npm.yml" as the workflow
# name, causing OIDC authentication to fail. To re-publish the npm package
# standalone, use workflow_dispatch on release.yml instead.

permissions:
  contents: read

jobs:
  publish-npm:
    name: Publish npm Package
    runs-on: ubuntu-24.04

    environment: release-npm

    permissions:
      contents: read
      id-token: write

    outputs:
      release_name: ${{ steps.version.outputs.release_name }}
      version: ${{ steps.version.outputs.version }}

    steps:
      - name: npm - Validate and parse version
        id: version
        env:
          RAW_VERSION: ${{ inputs.version }}
        run: |
          if [[ ! "${RAW_VERSION}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9.-]+)?$ ]]; then
            echo "::error::Version '${RAW_VERSION}' does not match ^vMAJOR.MINOR.PATCH(-PRERELEASE)?$"
            exit 1
          fi
          if ! git check-ref-format "refs/tags/${RAW_VERSION}" >/dev/null 2>&1; then
            echo "::error::Version '${RAW_VERSION}' is not a valid git tag ref name"
            exit 1
          fi
          echo "version=${RAW_VERSION}" >> "$GITHUB_OUTPUT"
          echo "release_name=${RAW_VERSION#v}" >> "$GITHUB_OUTPUT"

      - name: npm - Checkout tag
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: refs/tags/${{ steps.version.outputs.version }}
          persist-credentials: false

      - name: npm - Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: '.node-version'
          registry-url: 'https://registry.npmjs.org'

      - name: npm - Install dependencies
        run: npm ci --include=optional --ignore-scripts

      - name: npm - Build server
        run: npm run build -w server

      - name: npm - Validate version consistency
        run: |
          RELEASE_NAME="${{ steps.version.outputs.release_name }}"
          echo "Validating all version-bearing files match ${RELEASE_NAME}..."
          ./server/scripts/update-release-version.sh --check "${RELEASE_NAME}"

      - name: npm - Publish npm package
        working-directory: server
        run: |
          RELEASE_NAME="${{ steps.version.outputs.release_name }}"
          echo "Publishing codeql-development-mcp-server@${RELEASE_NAME} to npmjs.org via OIDC trusted publishing..."

          # Prerelease versions (containing a hyphen) must use a dist-tag other
          # than "latest" — npm enforces this to prevent prereleases from being
          # installed by default.
          if [[ "${RELEASE_NAME}" == *-* ]]; then
            # Extract the prerelease identifier before any dot
            # e.g., "2.24.1-prerelease" -> "prerelease", "2.24.1-beta.1" -> "beta"
            PRERELEASE_ID="${RELEASE_NAME#*-}"
            PRERELEASE_ID="${PRERELEASE_ID%%.*}"
            echo "Detected prerelease version — publishing with --tag ${PRERELEASE_ID}"
            npm publish --tag "${PRERELEASE_ID}"
          else
            npm publish
          fi
          echo "✅ Published npm package to npmjs.org (with provenance)"

      - name: npm - Upload release build artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-build-${{ steps.version.outputs.version }}
          path: |
            .node-version
            server/dist/
            server/ql/
            server/package.json
            server/scripts/setup-packs.sh
            README.md
            LICENSE
            docs/

      - name: npm - Summary
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          RELEASE_NAME="${{ steps.version.outputs.release_name }}"
          echo "## npm Package Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Detail | Value |" >> $GITHUB_STEP_SUMMARY
          echo "| ------ | ----- |" >> $GITHUB_STEP_SUMMARY
          echo "| Package | \`codeql-development-mcp-server\` |" >> $GITHUB_STEP_SUMMARY
          echo "| Version | ${RELEASE_NAME} |" >> $GITHUB_STEP_SUMMARY
          echo "| Registry | npmjs.org |" >> $GITHUB_STEP_SUMMARY
          echo "| Tag | ${VERSION} |" >> $GITHUB_STEP_SUMMARY