name: Publish package to NPM

on:
  push:
    tags:
      - 'v1.*.*'

permissions:
  contents: read
  id-token: write

jobs:
  publish:
    runs-on: ubuntu-latest
    environment: npm-publish
    steps:
      - name: Checkout repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24.x
          registry-url: 'https://registry.npmjs.org'
          package-manager-cache: false
      - name: Install dependencies
        run: npm ci --ignore-scripts
      - name: Build project
        run: npm run build
      - name: Publish to NPM
        run: npm publish --provenance --access public
