fission-ai__openspec/.github/workflows/release-publish.yml

name: Publish to npm

on:
  release:
    types: [published]
  workflow_dispatch: {}

permissions:
  contents: read
  id-token: write

concurrency:
  group: publish-${{ github.ref }}
  cancel-in-progress: false

jobs:
  publish:
    runs-on: ubuntu-latest
    env:
      NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: pnpm/action-setup@v4
        with:
          version: 9

      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'pnpm'
          registry-url: 'https://registry.npmjs.org'
          scope: '@fission-ai'
          always-auth: true

      - run: pnpm install --frozen-lockfile
      
      - name: Build project
        run: pnpm run build

      - name: Ensure running from a tag
        run: |
          if [[ "$GITHUB_REF" != refs/tags/* ]]; then
            echo "This workflow must run from a tag (got: $GITHUB_REF)";
            exit 1;
          fi

      - name: Verify release tag matches package.json
        run: |
          TAG="${GITHUB_REF_NAME#v}"
          PKG_VERSION=$(node -p "require('./package.json').version")
          if [ "$TAG" != "$PKG_VERSION" ]; then
            echo "Tag v$TAG does not match package.json $PKG_VERSION"; exit 1
          fi

      - name: Debug npm auth and context
        run: |
          test -n "$NODE_AUTH_TOKEN" || (echo "NODE_AUTH_TOKEN is missing" && exit 1)
          echo "NODE_AUTH_TOKEN present"
          npm --version
          pnpm --version
          node --version
          npm config get registry
          npm whoami
          npm ping

      - run: pnpm test

      - name: Publish
        run: pnpm publish --access public --provenance --no-git-checks --tag next