release.yml

name: Release

# Publishes to npm via trusted publishing (OIDC) — no npm token anywhere.
# Registered with npm as the trusted publisher for this package:
#   repo testingbot/mobilewright-testingbot, workflow release.yml, environment npm-publish
#
# The version bump, tag and GitHub release are made LOCALLY (see "Releasing"
# in the README): the org's IP allow list blocks GitHub-hosted runners from
# pushing to this repository, so CI only reads, builds and publishes.

on:
  release:
    types: [published]
  # Manual re-run, e.g. after a transient npm failure.
  workflow_dispatch:
    inputs:
      tag:
        description: Tag to publish (e.g. v0.2.0)
        required: true

permissions:
  contents: read
  id-token: write # the OIDC token npm exchanges for a publish credential

jobs:
  publish:
    runs-on: ubuntu-latest
    environment: npm-publish
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.release.tag_name || inputs.tag }}
      - uses: actions/setup-node@v4
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org
      # Trusted publishing needs npm >= 11.5.1
      - run: npm install -g npm@latest && npm --version

      - name: Tag must match package.json version
        run: |
          PKG_VERSION="$(node -p "require('./package.json').version")"
          TAG="${{ github.event.release.tag_name || inputs.tag }}"
          if [ "v${PKG_VERSION}" != "${TAG}" ] && [ "${PKG_VERSION}" != "${TAG}" ]; then
            echo "package.json is ${PKG_VERSION} but the tag is ${TAG}" >&2
            exit 1
          fi

      - run: npm ci
      - run: npm run typecheck
      - run: npm test

      - name: Publish to npm (OIDC)
        run: |
          VERSION="$(node -p "require('./package.json').version")"
          if npm view "@testingbot/mobilewright-driver@${VERSION}" version >/dev/null 2>&1; then
            echo "v${VERSION} is already on npm — nothing to do"
            exit 0
          fi
          npm publish # build runs via prepublishOnly; auth via OIDC