release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

permissions:
  contents: read
  id-token: write # npm provenance

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: "22"
          registry-url: "https://registry.npmjs.org"
      - name: Verify tag matches package.json version
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          PKG="$(node -p "JSON.parse(require('fs').readFileSync('package.json','utf8')).version")"
          TAG="${GITHUB_REF_NAME#v}"
          echo "package.json=$PKG tag=$TAG"
          test "$PKG" = "$TAG" || { echo "::error::version mismatch"; exit 1; }
      - name: Run tests
        run: node --test
      - name: Publish to npm
        run: npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}