name: Publish packages

on:
  push:
    branches: [v2]
  workflow_dispatch:

permissions:
  contents: read
  id-token: write

concurrency: ${{ github.workflow }}-${{ github.ref }}

jobs:
  build:
    runs-on: ubuntu-latest
    environment:
      name: azure
      deployment: false
    if: github.repository == 'microsoft/TypeScript-Website'

    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0
          filter: blob:none
          persist-credentials: false
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "20.x"
          registry-url: "https://registry.npmjs.org/"
      - uses: pnpm/action-setup@903f9c1a6ebcba6cf41d87230be49611ac97822e # v6.0.3

      - name: Prepare website v2
        run: |
          pnpm install
          pnpm bootstrap
          pnpm build

      - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
        with:
          client-id: ${{ vars.AZURE_CLIENT_ID }}
          tenant-id: ${{ vars.AZURE_TENANT_ID }}
          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}

      - name: Create GitHub App token
        id: app-token
        uses: microsoft/create-github-app-token-via-key-vault@5ba0d436e9c3cac52feff4d1f2f66f9698ce4a2d # v1
        with:
          client-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_CLIENT_ID }}
          key-id: ${{ vars.TYPESCRIPT_AUTOMATION_GITHUB_APP_KEY_ID }}
          owner: microsoft
          repositories: TypeScript-Website
          permission-contents: write
          permission-pull-requests: write
      - name: Configure git for GitHub App token
        shell: bash
        env:
          GITHUB_APP_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          set -euo pipefail
          basic_auth="<redacted>"
          echo "::add-mask::$basic_auth"
          git config --local http.https://github.com/.extraheader "AUTHORIZATION: basic ${basic_auth}"
      - uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1.7.0
        with:
          publish: pnpm ci:publish
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
