publish.yml

name: Publish to npm

on:
  release:
    types: [published]
  workflow_dispatch:

permissions:
  contents: read
  id-token: write

jobs:
  publish:
    runs-on: ubuntu-latest
    environment:
      name: npm-publish
      url: https://www.npmjs.com/package/@amazon-connect-touchpoint/web
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22
          registry-url: 'https://registry.npmjs.org'

      - name: Ensure npm 11.5.1+ for trusted publishing
        run: |
          echo "Current npm version: $(npm --version)"
          npm install -g npm@11.5.1
          echo "Updated npm version: $(npm --version)"

      - name: Install dependencies
        run: npm ci

      - name: Verify release tag matches package.json version
        if: github.event_name == 'release'
        run: |
          PKG_VERSION="$(node -p 'require("./package.json").version')"
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          echo "package.json: $PKG_VERSION / tag: $TAG_VERSION"
          if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then
            echo "::error::Release tag $GITHUB_REF_NAME does not match package.json version $PKG_VERSION. Commit the version bump before tagging."
            exit 1
          fi

      - name: Determine npm dist-tag
        run: |
          VERSION="$(node -p 'require("./package.json").version')"
          # A prerelease version (1.1.0-alpha.3) must not land on the "latest"
          # dist-tag, or plain `npm install` would hand it to every consumer.
          # Use the prerelease identifier as the tag: 1.1.0-alpha.3 -> alpha.
          case "$VERSION" in
            *-*)
              PREID="$(echo "${VERSION#*-}" | cut -d. -f1)"
              case "$PREID" in
                # A numeric identifier (1.0.2-0, from `npm version prerelease`
                # with no --preid) is a valid SemVer range, which npm rejects
                # as a dist-tag. Fall back to a generic channel.
                *[!0-9]*) DIST_TAG="$PREID" ;;
                *)        DIST_TAG="next" ;;
              esac
              ;;
            *) DIST_TAG="latest" ;;
          esac
          echo "Publishing $VERSION under dist-tag: $DIST_TAG"
          echo "DIST_TAG=$DIST_TAG" >> "$GITHUB_ENV"

      - name: Build
        run: npm run build

      - name: Publish dry-run
        run: npm publish --access public --provenance --tag "$DIST_TAG" --dry-run

      - name: Publish to npm (using OIDC trusted publishing)
        if: github.event_name == 'release'
        run: |
          echo "Publishing with OIDC trusted publishing..."
          npm publish --access public --provenance --tag "$DIST_TAG"