ci.yml

# Continuous integration - validate builds when commits are made, and publish when releases are created.
#
name: "Continuous Integration"

# Run the build on all push, pull request, and release creation events.
on:
  pull_request:
  push:
  release:
    types: [ published ]
  workflow_dispatch:

jobs:

  # Run a validation build on LTS versions of node.
  build:
    name: 'Build package'

    # Create the build matrix for all the environments we're validating against.
    strategy:
      matrix:
        node-version: [ lts/-1, lts/* ]
        os: [ ubuntu-latest ]

    # Specify the environments we're going to build in.
    runs-on: ${{ matrix.os }}

    # Execute the build activities.
    steps:
      - name: Checkout the repository.
        uses: actions/checkout@v4

      - name: Setup the node ${{ matrix.node-version }} environment.
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}

      - name: Build and install the package with a clean slate.
        env:
          CI: true
          ESLINT_MAX_WARNINGS: 0
        run: |
          npm ci
          npm run prepublishOnly

  # Publish the release to the NPM registry.
  publish-npm:
    name: 'Publish package'
    needs: build

    # Publish only if we've received a release event and the tag starts with "v" (aka v1.2.3).
    if: github.event_name == 'release' && startsWith(github.ref, 'refs/tags/v')

    # Specify the environment we're going to build in.
    runs-on: ubuntu-latest

    # Ensure we have permissions to provide our provenance attestation.
    permissions:
       id-token: write

    # Execute the build and publish activities.
    steps:
    - name: Checkout the repository.
      uses: actions/checkout@v4

    - name: Setup the node environment.
      uses: actions/setup-node@v4
      with:

        # Use the oldest node LTS version that we support.
        node-version: lts/-1

        # Use the NPM registry.
        registry-url: 'https://registry.npmjs.org/'

    - name: Install the package with a clean slate.
      run: npm ci

    - name: Publish the package to NPM.
      run: npm publish --access public --provenance
      env:
        NODE_AUTH_TOKEN: ${{ secrets.npm_token }}