name: Publish

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

jobs:
  verify-npm:
    runs-on: ubuntu-latest
    steps:
      - name: checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          submodules: true
          persist-credentials: false

      - name: setup deno
        uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5
        with:
          deno-version: v2.x

      - name: build wasm
        run: make

      - name: Get Version
        id: vars
        run: echo "version=$(echo "${GITHUB_REF_NAME}" | sed 's/^v//')" >> $GITHUB_OUTPUT

      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          package-manager-cache: false
          cache: ""

      - name: Build NPM
        run: deno task build:npm "${STEPS_VARS_OUTPUTS_VERSION}"
        env:
          STEPS_VARS_OUTPUTS_VERSION: ${{steps.vars.outputs.version}}

      - name: dry run publish
        run: npm publish --dry-run --tag=verify
        working-directory: ./build/npm

      - name: upload build
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: npm-build
          path: ./build/npm

  publish-npm:
    needs: [verify-npm]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write

    steps:
      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          package-manager-cache: false
          cache: ""

      - name: download build
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: npm-build
          path: ./build/npm

      - name: Publish NPM
        run: npm publish --access=public --tag=latest
        working-directory: ./build/npm
