name: Publish

on:
  push:
    tags: ["v*"]

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Check tag is on main
        run: git merge-base --is-ancestor "$GITHUB_SHA" origin/main || { echo "::error::$GITHUB_REF_NAME is not on main"; exit 1; }

      - uses: actions/setup-node@v7
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"
          # A poisoned cache could leak the OIDC token to attacker-controlled code
          package-manager-cache: false

      - name: Check tag matches package.json version
        run: test "$GITHUB_REF_NAME" = "v$(node -p 'require("./package.json").version')"

      - run: npm ci

      # Trusted publishing (OIDC) is used once configured on npmjs.com; NPM_TOKEN is the fallback for the first publish
      - run: npm publish --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

  docs:
    needs: publish
    runs-on: ubuntu-latest
    permissions:
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v7
        with:
          node-version: "24"
          package-manager-cache: false

      - run: npm ci

      - run: npm run docs

      - uses: actions/upload-pages-artifact@v5
        with:
          path: docs

      - id: deployment
        uses: actions/deploy-pages@v5