name: Publish SDK to npm

on:
  push:
    branches: [main]
    paths:
      - 'packages/sdk/**'
      - 'package.json'
      - 'pnpm-lock.yaml'
      - 'pnpm-workspace.yaml'
      - 'tsconfig.base.json'
  workflow_dispatch:

permissions:
  contents: read
  id-token: write

concurrency:
  group: sdk-npm-publish-${{ github.ref }}
  cancel-in-progress: false

jobs:
  publish:
    name: Build, test, and publish SDK
    runs-on: ubuntu-latest
    environment: SnowLuma
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@v6
        with:
          version: 11.25.0
          run_install: false

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          # Trusted Publishing requires Node >=22.14 and npm >=11.5.1.
          # Use the same patched runtime as application builds.
          node-version-file: '.node-version'
          cache: 'pnpm'
          registry-url: 'https://registry.npmjs.org'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Type check SDK
        run: pnpm --filter @snowluma/sdk typecheck

      - name: Test SDK
        run: pnpm --filter @snowluma/sdk test

      - name: Build SDK
        run: pnpm --filter @snowluma/sdk build

      - name: Check npm package version
        id: npm
        working-directory: packages/sdk
        shell: bash
        run: |
          set -euo pipefail
          package_name="$(node -e "const fs = require('node:fs'); console.log(JSON.parse(fs.readFileSync('package.json', 'utf8')).name)")"
          package_version="$(node -e "const fs = require('node:fs'); console.log(JSON.parse(fs.readFileSync('package.json', 'utf8')).version)")"

          {
            echo "package_name=${package_name}"
            echo "package_version=${package_version}"
          } >> "${GITHUB_OUTPUT}"

          if npm view "${package_name}@${package_version}" version >/dev/null 2>&1; then
            echo "already_published=true" >> "${GITHUB_OUTPUT}"
            echo "::notice::${package_name}@${package_version} already exists on npm; skipping publish."
          else
            echo "already_published=false" >> "${GITHUB_OUTPUT}"
          fi

      - name: Show Trusted Publishing toolchain
        if: steps.npm.outputs.already_published != 'true'
        run: |
          node --version
          npm --version

      - name: Publish SDK to npm
        if: steps.npm.outputs.already_published != 'true'
        working-directory: packages/sdk
        # Authentication is supplied by npm Trusted Publishing through the
        # GitHub OIDC token (permissions.id-token: write above).
        run: npm publish --access public --provenance

      - name: Summary
        shell: bash
        run: |
          {
            echo "## SDK npm publish"
            echo
            echo "| Key | Value |"
            echo "| --- | --- |"
            echo "| Package | \`${{ steps.npm.outputs.package_name }}\` |"
            echo "| Version | \`${{ steps.npm.outputs.package_version }}\` |"
            echo "| Already published | \`${{ steps.npm.outputs.already_published }}\` |"
            echo "| Environment | \`SnowLuma\` |"
            echo "| Authentication | npm Trusted Publishing (GitHub OIDC) |"
          } >> "${GITHUB_STEP_SUMMARY}"