publish.yml

name: Publish to npm

on:
  release:
    types: [published]

jobs:
  publish:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'
          cache: npm

      - run: npm install -g npm@11.19.0
      - run: npm ci
      - name: Verify release tag matches package version
        run: node -e "const version=require('./package.json').version; const expected='v'+version; if(process.env.GITHUB_REF_NAME!==expected){console.error('Expected release tag '+expected+', got '+process.env.GITHUB_REF_NAME); process.exit(1)}"
      - name: Publish to npm (prepack runs verification)
        run: npm publish --access public --provenance --registry https://registry.npmjs.org