npm-publish.yml

name: Build and Publish React Package

on:
  push:
    branches:
      - main
      - master
  workflow_dispatch:

jobs:
  test:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: "npm"
          cache-dependency-path: package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Run tests
        run: npm test

  build-and-publish:
    needs: test
    runs-on: ubuntu-latest

    permissions:
      contents: read
      id-token: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: "npm"
          cache-dependency-path: package-lock.json

      - name: Show toolchain
        run: |
          npm --version
          node --version

      - name: Install dependencies
        run: npm ci --no-audit --no-fund

      - name: Install PostCSS CLI globally (for build step)
        run: npm install -g postcss postcss-cli

      - name: Build package
        run: npm run build

      - name: Debug OIDC identity
        run: |
          echo "repo=$GITHUB_REPOSITORY"
          echo "ref=$GITHUB_REF"
          echo "workflow_ref=$GITHUB_WORKFLOW_REF"
          echo "oidc_url_set=${ACTIONS_ID_TOKEN_REQUEST_URL:+yes}"

      - name: Prepare npm for OIDC trusted publish
        run: |
          npm config set registry https://registry.npmjs.org/
          npm config delete //registry.npmjs.org/:_authToken || true
          npm config list

      - name: Publish to npm
        if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master'
        run: npm publish --access public --provenance

  create_release:
    name: Create GitHub Release
    needs: build-and-publish
    runs-on: ubuntu-latest

    permissions:
      contents: write

    if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master'

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Get version and create tag
        id: version
        run: |
          VERSION=$(jq -r '.version' package.json)
          echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
          echo "TAG_NAME=v${VERSION}" >> $GITHUB_OUTPUT
          if git tag -l "v${VERSION}" | grep -q "v${VERSION}"; then
            echo "TAG_EXISTS=true" >> $GITHUB_OUTPUT
          else
            echo "TAG_EXISTS=false" >> $GITHUB_OUTPUT
          fi

      - name: Create and push tag
        if: steps.version.outputs.TAG_EXISTS == 'false'
        run: |
          git config --global user.name "github-actions[bot]"
          git config --global user.email "github-actions[bot]@users.noreply.github.com"
          git tag -a "${{ steps.version.outputs.TAG_NAME }}" -m "Release ${{ steps.version.outputs.TAG_NAME }}"
          git push origin "${{ steps.version.outputs.TAG_NAME }}"

      - name: Create GitHub Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "# Release ${{ steps.version.outputs.TAG_NAME }}" > release-notes.md
          echo "" >> release-notes.md
          echo "## Changes" >> release-notes.md
          echo "- Automated release from commit $(git rev-parse --short HEAD)" >> release-notes.md
          gh release create "${{ steps.version.outputs.TAG_NAME }}" \
            --title "Release ${{ steps.version.outputs.TAG_NAME }}" \
            --notes-file release-notes.md