name: releaseEtherpad.yaml
permissions:
  contents: read
  id-token: write   # for npm OIDC trusted publishing
on:
  workflow_dispatch:

env:
  PNPM_HOME: ~/.pnpm-store

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
        - name: Checkout repository
          uses: actions/checkout@v6
        - uses: actions/setup-node@v6
          with:
            # OIDC trusted publishing needs npm >= 11.5.1, which requires
            # Node >= 22.9.0. setup-node's `22` resolves to the latest
            # 22.x, which satisfies that.
            node-version: 22
            registry-url: https://registry.npmjs.org/
        - name: Upgrade npm to >=11.5.1 (required for trusted publishing)
          run: npm install -g npm@latest
        - uses: actions/cache@v5
          name: Cache pnpm store
          with:
            path: ${{ env.PNPM_HOME }}
            key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
            restore-keys: |
              ${{ runner.os }}-pnpm-store-
        - uses: pnpm/action-setup@v6
          name: Install pnpm
          with:
            run_install: false
        - name: Install dependencies
          run: pnpm install --frozen-lockfile
        - name: Rename etherpad
          working-directory: ./src
          run: sed -i 's/ep_etherpad-lite/ep_etherpad/g' package.json
        # Use `npm publish` directly (not the `pnpm` wrapper) because OIDC
        # trusted publishing requires npm CLI >= 11.5.1 and the wrapper shells
        # out to npm; calling npm directly avoids any shim ambiguity. The
        # ep_etherpad package must have a trusted publisher configured on
        # npmjs.com pointing at this workflow file. See:
        # https://docs.npmjs.com/trusted-publishers
        - name: Release to npm via OIDC
          run: npm publish --provenance --access public
          working-directory: ./src