# Reusable workflow: publish @openmeter/sdk to npm via OIDC Trusted Publishing.
#
# npm validates the top-level (caller) workflow filename for trusted publishing,
# not this reusable file. The trusted publisher entry on npmjs.com is therefore
# configured against the caller workflow (e.g. release.yaml) + environment prod.
# See: https://github.com/npm/documentation/issues/1755

name: NPM Release

on:
  workflow_call:
    inputs:
      version:
        description: "Version to publish (without leading v; pnpm strips it anyway)."
        required: true
        type: string
      dist-tag:
        description: "npm dist-tag to publish under (e.g. latest, beta)."
        required: true
        type: string

# Restrictive default; the publish job opens id-token: write itself.
permissions:
  contents: read

jobs:
  publish:
    name: Publish @openmeter/sdk
    # npm trusted publishing with provenance currently requires a GitHub-hosted runner.
    runs-on: ubuntu-latest
    environment: prod

    # npm Trusted Publishing: GitHub mints a short-lived OIDC token that npm
    # exchanges for a publish token. Requires id-token: write and a matching
    # trusted publisher configuration on npmjs.com.
    permissions:
      contents: read
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      # Trusted publishing requires npm CLI >= 11.5.1 on PATH so npm can
      # perform the OIDC handshake. setup-node provides a current npm and
      # writes a registry-scoped .npmrc with no _authToken.
      - name: Set up pnpm
        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
        with:
          package_json_file: api/client/javascript/package.json

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: .nvmrc
          cache: pnpm
          cache-dependency-path: api/client/javascript/pnpm-lock.yaml
          registry-url: 'https://registry.npmjs.org'

      - name: Publish NPM package
        run: make -C api/client/javascript publish-javascript-sdk
        env:
          JS_SDK_RELEASE_VERSION: ${{ inputs.version }}
          JS_SDK_RELEASE_TAG: ${{ inputs.dist-tag }}
          NPM_CONFIG_PROVENANCE: "true"