release.yml

# Publish @openmarkdown-dev/css to npm when a version tag is pushed.
#
# Trigger: a tag `v<version>` whose version equals package.json's. The version
# is the editor package's: both are exported in the same release run and tagged
# with the same `v<version>` (see the release runbook in the source monorepo:
# docs/release/editor-publish.md).
#
# Authentication, in order of preference:
#   1. npm trusted publishing (OIDC): configure this repository + this workflow
#      file as a trusted publisher on npmjs.com; no token is stored anywhere.
#   2. an `NPM_TOKEN` repository secret (a granular automation token limited to
#      @openmarkdown-dev/css), used only when the secret is set.
# Either way the package is published with a provenance attestation
# (`--provenance`), which needs `id-token: write`.
name: Release

on:
  push:
    tags: ["v*"]

permissions:
  contents: read
  id-token: write

jobs:
  publish:
    runs-on: ubuntu-latest
    environment: npm
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org
      # Trusted publishing needs npm >= 11.5.1.
      - run: npm install -g npm@^11.5.1
      - name: Tag matches package.json
        run: |
          v="$(node -p 'require("./package.json").version')"
          [ "${GITHUB_REF_NAME}" = "v${v}" ] || { echo "tag ${GITHUB_REF_NAME} != v${v}"; exit 1; }
      - name: No unfilled placeholders
        run: |
          if grep -rnE '\{\{[A-Z_]+\}\}' --exclude-dir=node_modules --exclude-dir=.git .; then
            echo "fill in the placeholders listed above before publishing"; exit 1
          fi
      - name: Package contents
        run: npm pack --dry-run
      - name: Publish with provenance
        run: npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}