release.yml

name: Release

on:
  push:
    tags: ['v*']

# Publishing is gated on the browser tests. Every guarantee this project makes
# is about undocumented Chrome behaviour, so a release that skipped them would
# be shipping an unverified claim.
jobs:
  release:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: write # create the GitHub Release
      id-token: write # npm trusted publishing (OIDC) and provenance

    env:
      CHROME_PIN: '151.0.7922.71'

    steps:
      - uses: actions/checkout@v4

      # No `registry-url`: it writes `//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}`
      # into .npmrc, and with no token that line expands to an empty value. npm
      # reads it as "authentication is configured" and never starts the OIDC
      # exchange, failing with ENEEDAUTH. registry.npmjs.org is the default
      # anyway, so the line buys nothing and costs the whole mechanism.
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - run: npm ci

      - name: Check the tag matches the packages
        run: |
          TAG="${GITHUB_REF_NAME#v}"
          for p in core cdp mcp; do
            V=$(node -p "require('./packages/$p/package.json').version")
            if [ "$V" != "$TAG" ]; then
              echo "::error::Tag is v$TAG but packages/$p is $V. Use 'node scripts/version.mjs $TAG' so every package and cross-dependency moves together."
              exit 1
            fi
          done
          echo "VERSION=$TAG" >> "$GITHUB_ENV"

      - name: Install Chrome ${{ env.CHROME_PIN }}
        run: |
          OUT=$(npx --yes @puppeteer/browsers install "chrome@${CHROME_PIN}")
          echo "CHROME_PATH=${OUT##* }" >> "$GITHUB_ENV"

      - run: npm run build:all

      - name: Test before publishing
        run: npm test

      - name: Use an npm that can do trusted publishing
        # Deliberately after `npm ci`, not before. Node 22 ships npm 10 and the
        # lockfile is generated by it; npm 11 resolves optional platform
        # packages differently and rejects that same lockfile as out of sync.
        # The newer npm is only needed to publish — OIDC requires 11.5.1 — so
        # upgrading here keeps install and lockfile on the same npm.
        run: |
          npm i -g npm@^11
          npm --version

      - name: Make sure nothing looks like configured auth
        # Any leftover _authToken line reads as "auth is configured" and stops
        # the OIDC exchange before it starts.
        run: |
          NPMRC="${NPM_CONFIG_USERCONFIG:-$HOME/.npmrc}"
          [ -f "$NPMRC" ] && sed -i '/_authToken/d' "$NPMRC" || true
          echo "npmrc after cleanup:"; cat "$NPMRC" 2>/dev/null || echo "(none)"

      - name: Publish to npm
        # Authenticated by OIDC, which requires a trusted publisher configured on
        # npmjs.com for each package: owner motionvector-dev, repo webcodecs-census,
        # workflow release.yml. No long-lived token exists to leak or rotate.
        run: node scripts/publish.mjs

      - name: Package the extension for the Chrome Web Store
        run: cd extension/dist && zip -qr "../../webcodecs-census-extension-${VERSION}.zip" .

      - name: Release notes
        run: node scripts/release-notes.mjs "$VERSION" > RELEASE_NOTES.md

      - name: Create the GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "$GITHUB_REF_NAME" \
            --title "v$VERSION" \
            --notes-file RELEASE_NOTES.md \
            "webcodecs-census-extension-${VERSION}.zip" \
            || gh release upload "$GITHUB_REF_NAME" "webcodecs-census-extension-${VERSION}.zip" --clobber