publish.yml

name: Publish
on:
  push:
    tags:
      - 'v*'

permissions:
  contents: read
  id-token: write

jobs:
  publish:
    runs-on: ubuntu-24.04

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup
        uses: ./.github/actions/setup

      - name: Check the tag against package.json
        run: test "v$(node -p "require('./package.json').version")" = "$GITHUB_REF_NAME"

      # Staged publishing needs npm 11.15 or newer; Node 24.13 ships 11.6.
      - name: Update npm
        run: npm install -g npm@11.19.1

      - name: Generate nitrogen code
        run: yarn nitrogen

      - name: Build package
        run: yarn prepare

      # Trusted publishing stages each package; the versions go live once approved on npmjs.com, the core first.
      # A re-run skips only the live versions, so approve or reject the staged ones before it.
      - name: Stage the core, then the language packages
        run: |
          stage() {
            name=$(node -p "require('./$1/package.json').name")
            version=$(node -p "require('./$1/package.json').version")
            if [ -n "$(npm view "$name@$version" version 2>/dev/null)" ]; then
              echo "$name@$version is already on npm, skipping"
              return
            fi
            (cd "$1" && npm stage publish --provenance --access public --ignore-scripts)
          }
          stage .
          for pkg in languages/*/package.json; do
            stage "$(dirname "$pkg")"
          done