release.yml

name: Release

# Triggered by:
# - push to main:  move mobile 'alpha' git tag, no npm publish
# - push tag v*:   publish to npm @latest, move 'latest' mobile tag, GitHub Release
#
# Releases are explicit: you have to create and push a tag v<version> to
# publish. Pushing to main only moves the 'alpha' mobile tag.

on:
  push:
    branches: [main]
    tags: ['v*']

jobs:
  release:
    name: Build + Release
    runs-on: ubuntu-latest

    permissions:
      contents: write
      id-token: write

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: npm
          registry-url: https://registry.npmjs.org

      - name: Install, lint, build, test
        run: |
          npm ci
          npx biome check src/ test/
          npm run build
          npm test

      # --- main branch push: move mobile 'alpha' git tag, done ---

      - name: Move mobile 'alpha' git tag (main)
        if: github.ref_type == 'branch' && github.ref_name == 'main'
        run: |
          git tag -f alpha
          git push origin alpha --force

      # --- tag push (v*): publish to npm, mobile 'latest', GitHub Release ---

      - name: Compute version from tag
        if: github.ref_type == 'tag'
        id: v
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "Publishing version: $VERSION"

      - name: Guard - tag must be stable version
        if: github.ref_type == 'tag' && contains(steps.v.outputs.version, '-')
        run: |
          echo "Tag ${{ github.ref_name }} is a pre-release (contains '-')"
          echo "Only stable tags (e.g. v0.1.0) are published to @latest"
          exit 1

      - name: Guard - tag must be an ancestor of main
        if: github.ref_type == 'tag'
        run: |
          git fetch origin main --quiet
          if ! git merge-base --is-ancestor $GITHUB_SHA origin/main; then
            echo "Tag ${{ github.ref_name }} is not on the main branch."
            echo "Only commits already merged to main can be released."
            echo "Merge your changes to main first, then create the tag from main."
            exit 1
          fi
          echo "Tag commit is an ancestor of main, release approved."

      - name: Set version in-memory
        if: github.ref_type == 'tag'
        run: npm version ${{ steps.v.outputs.version }} --no-git-tag-version --allow-same-version

      - name: Check if version already on npm
        if: github.ref_type == 'tag'
        id: npm_check
        run: |
          if npm view light-process@${{ steps.v.outputs.version }} version >/dev/null 2>&1; then
            echo "exists=true" >> $GITHUB_OUTPUT
            echo "Version ${{ steps.v.outputs.version }} already on npm, skipping publish"
          else
            echo "exists=false" >> $GITHUB_OUTPUT
          fi

      - name: Publish to npm
        if: github.ref_type == 'tag' && steps.npm_check.outputs.exists == 'false'
        run: npm publish --tag latest --provenance --access public

      - name: Move mobile 'latest' git tag
        if: github.ref_type == 'tag' && steps.npm_check.outputs.exists == 'false'
        run: |
          git tag -f latest
          git push origin latest --force

      - name: Create GitHub Release
        if: github.ref_type == 'tag' && steps.npm_check.outputs.exists == 'false'
        run: gh release create ${{ github.ref_name }} --generate-notes
        env:
          GH_TOKEN: ${{ github.token }}