publish-cli.yml

name: publish CLI to npm

# Triggers only when a tag matching v*.*.* is pushed. Bump the version in
# packages/cli/package.json, commit, then `git tag vX.Y.Z && git push --tags`.
on:
  push:
    tags:
      - "v*.*.*"

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  publish:
    name: build + publish stylesheet-ui
    runs-on: ubuntu-latest
    # `id-token: write` enables npm provenance, which embeds the GitHub Actions
    # build context into the published package so consumers can verify it.
    permissions:
      contents: write
      id-token: write

    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-node@v5
        with:
          node-version: 22
          registry-url: https://registry.npmjs.org
          cache: npm

      - name: Install dependencies
        run: npm ci

      # Refuse to publish if `git tag vX.Y.Z` doesn't match the version field
      # in packages/cli/package.json. Catches the common "tagged the wrong
      # commit / forgot to bump" mistake before npm sees it.
      - name: Verify tag matches package version
        run: |
          TAG="${GITHUB_REF#refs/tags/v}"
          PKG=$(node -p "require('./packages/cli/package.json').version")
          if [ "$TAG" != "$PKG" ]; then
            echo "::error::Tag v$TAG does not match packages/cli/package.json version $PKG."
            exit 1
          fi
          echo "✓ Tag v$TAG matches package.json version $PKG."

      - name: Typecheck all workspaces
        run: npm run typecheck

      # The CLI's `prepublishOnly` already runs sync + build, but doing it
      # explicitly here surfaces failures in the workflow timeline.
      - name: Sync registry
        run: npm run registry:sync

      - name: Build CLI
        run: npm run cli:build

      - name: Publish
        working-directory: packages/cli
        run: npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          name: ${{ github.ref_name }}
          generate_release_notes: true