ci.yml

name: CI

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
    branches: ["*"]

jobs:
  push:
    name: push
    runs-on: ubuntu-latest

    permissions:
      # https://docs.npmjs.com/generating-provenance-statements#publishing-packages-with-provenance-via-github-actions
      id-token: write

    steps:
      - uses: actions/checkout@v4.2.2
      - run: corepack enable
      - uses: actions/setup-node@v4.1.0
        with:
          node-version: 22.x
          registry-url: https://registry.npmjs.org
          cache: yarn

      - run: yarn install --immutable
      - run: yarn run lint:ci
      - run: yarn run build
      - run: yarn run test

      - run: yarn pack
      - name: Publish to NPM
        if: ${{ startsWith(github.ref, 'refs/tags/v') }}
        # `yarn npm publish` does not currently support --provenance: https://github.com/yarnpkg/berry/issues/5430
        run: npm publish package.tgz --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}