ci.yaml

name: Check and release

on:
  pull_request:
  push:
    branches: [master]

permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      interface: ${{ steps.releases.outputs.interface }}
      sdk: ${{ steps.releases.outputs.sdk }}

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
          # The release rule below reads the previous commit.
          fetch-depth: 2
      # The image's npm installs the pnpm version package.json pins, verified by the
      # registry's integrity field (npm ignores the hash in packageManager); pnpm then
      # installs the Node the lockfile pins (devEngines.runtime) and runs every script on it.
      - run: npm install --global pnpm@"$(node -p "require('./package.json').packageManager.split('@')[1]")"

      - name: Install pinned dependencies
        run: pnpm install --frozen-lockfile
      - name: Run pnpm check
        run: pnpm check
      # The freshness checks depend on the date, not the tree: an advisory is published, a
      # dependency or Node release ages past its waiting period, an action releases. They
      # gate pull requests only, so a release push cannot fail on something that appeared
      # after the review; the next pull request catches it.
      - if: github.event_name == 'pull_request'
        run: pnpm fresh

      # A release is a push to master (the only push trigger) whose commit changes a
      # package's version field. The ruleset admits only merge commits of pull requests,
      # whose first parent is the previous tip, so HEAD^ is the comparison; a path absent
      # there counts as changed.
      - id: releases
        if: github.event_name == 'push'
        run: |
          released() {
            now=$(node -p "require('./$1/package.json').version")
            before=$(git show "HEAD^:$1/package.json" 2>/dev/null | node -p "JSON.parse(require('fs').readFileSync(0, 'utf8')).version" 2>/dev/null || echo none)
            if [ "$now" != "$before" ]; then echo true; else echo false; fi
          }
          echo "interface=$(released interface)" >> "$GITHUB_OUTPUT"
          echo "sdk=$(released sdk)" >> "$GITHUB_OUTPUT"

  # The release jobs build again from a fresh checkout in which none of the gate's tooling
  # has run; the interface job installs the workspace because its build bundles the SDK
  # from source. A failed run leaves the previous release live.
  deploy:
    needs: build
    if: needs.build.outputs.interface == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - run: npm install --global pnpm@"$(node -p "require('./package.json').packageManager.split('@')[1]")"
      - run: pnpm install --frozen-lockfile
      - run: pnpm --filter @ickb/interface build
      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9
        with:
          path: interface/dist
      - id: deployment
        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346

  # npm trusted publishing: the id token stands in for a registry token, and npm records
  # the provenance of this run with the package. The environment's branch policy admits
  # master only, so a token minted on another branch is refused.
  publish:
    needs: build
    if: needs.build.outputs.sdk == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    environment: npm

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - run: npm install --global pnpm@"$(node -p "require('./package.json').packageManager.split('@')[1]")"
      # `pnpm deploy` resolves only the SDK's dependencies from the lockfile and refuses the
      # package directory as its target, so its node_modules moves into place. npm runs the
      # build script because `pnpm run` would first install the whole workspace
      # (verifyDepsBeforeRun defaults to install).
      - run: pnpm --filter @ickb/sdk deploy --frozen-lockfile /tmp/deploy && mv /tmp/deploy/node_modules sdk/node_modules
      # This tree has no devEngines, so these two commands run on the image's Node, which
      # may trail the floor; tsgo is a native binary and the rewrite script only edits import
      # specifiers, so the artifact does not depend on it.
      - run: npm run build
        working-directory: sdk
      # Access comes from publishConfig. The flag keeps provenance explicit: without it pnpm
      # decides from the OIDC token and, when the visibility lookup fails, warns and continues
      # without provenance. The checkout is a detached commit, so pnpm's branch and remote
      # checks do not apply.
      - name: Publish @ickb/sdk
        run: pnpm --filter @ickb/sdk publish --provenance --no-git-checks