release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write
  id-token: write # for npm provenance via OIDC trusted publisher

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          registry-url: 'https://registry.npmjs.org'
          cache: 'npm'

      - name: Install + build + test engine
        working-directory: engine
        run: |
          npm install --no-audit --no-fund
          npm run build
          npm test

      - name: Pack tarball
        working-directory: engine
        run: npm pack

      - name: Publish to npm with provenance
        id: npm_publish
        working-directory: engine
        continue-on-error: true
        run: npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Create GitHub Release
        if: always()
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          files: engine/*.tgz

      - name: Surface npm publish failure (after creating GH release)
        if: steps.npm_publish.outcome == 'failure'
        run: |
          echo "::warning ::npm publish failed (no trusted publisher / NPM_TOKEN configured)."
          echo "::warning ::GitHub Release was still created. Publish manually with: cd engine && npm publish --access public"
          exit 1