name: Release

on:
  push:
    tags: ['v[0-9]+.[0-9]+.[0-9]+']

permissions:
  contents: read
  id-token: write

jobs:
  publish:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@v7.0.0
        with:
          cache: npm
          node-version: 24
          registry-url: https://registry.npmjs.org
      - run: npm ci
      - name: The tag must match the version being published
        run: |
          tagged="${GITHUB_REF_NAME#v}"
          packaged="$(node -p 'require("./package.json").version')"
          test "$tagged" = "$packaged" || {
            echo "tag $GITHUB_REF_NAME does not match package.json $packaged"
            exit 1
          }
      - run: npm run lint
      - run: npm test
      - run: npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}