npm.yml

name: Publish to NPM
on:
  release:
    types: [published]
permissions:
  contents: read
  id-token: write

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
      # Setup .npmrc file to publish to npm
      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
        with:
          node-version: '22.x'
          registry-url: 'https://registry.npmjs.org'
      - run: npm ci
      - run: npm run build
        env:
          IS_PUBLISHING: 'YES'

      - name: Check if pre-release and publish to NPM
        run: |
          VERSION=$(node -p "require('./package.json').version")
          if [[ "$VERSION" == *"-"* ]]; then
            echo "Publishing pre-release: $VERSION"
            npm publish --provenance --access=public --tag rc
          else
            echo "Publishing stable release: $VERSION"
            npm publish --provenance --access=public
          fi
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}