name: Publish to npm

on:
  release:
    types: [published]

permissions:
  contents: read
  id-token: write

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          # no cache — lockfile not committed (platform-specific native deps)
          registry-url: https://registry.npmjs.org

      - run: npm install
      # Build BEFORE test. Examples in test/examples-smoke.test.ts import
      # from the package name 'agentfootprint', resolved via the local
      # package's main/exports → dist/. Without an upstream build those
      # imports fail. (Same fix as in ci.yml.)
      - run: npm run build
      - run: npm test

      # Trusted publishing requires npm >= 11.5.1, but newer npm
      # changes optional peer-dep resolution in ways that can break
      # the test suite. Upgrade ONLY for the publish step, AFTER tests.
      - run: npm install -g npm@latest

      # Trusted publishing: no NODE_AUTH_TOKEN set. npm CLI authenticates
      # to the registry via the GitHub OIDC token (granted by id-token:
      # write permission above). npm verifies the publish is from a
      # trusted GitHub workflow per the package's trusted-publisher config.
      - name: Publish to npm
        run: npm publish --provenance --access public
