npm_release_cli.yml

name: 'nativescript -> npm'

on:
  push:
    branches:
      - main
    tags:
      - "v*"
    paths-ignore:
      - 'packages/**'
  workflow_dispatch:
    inputs:
      release_type:
        description: >-
          Release to cut. Leave empty for a rolling "next" prerelease (no version
          bump). "dev" publishes a -dev prerelease (no bump). A semver keyword
          (patch/minor/major) or an explicit version (e.g. 9.1.0, 9.1.0-alpha.1)
          bumps package.json, commits + tags v<version>, then publishes a stable
          release. A prerelease version publishes under the dist-tag matching its
          prerelease id (alpha/beta/rc); a plain version publishes under "latest".
        type: string
        required: false
        default: ''

permissions: read-all

env:
  NPM_TAG: 'next'

jobs:
  build:
    name: Build
    runs-on: macos-latest
    permissions:
      contents: write
    outputs:
      npm_version: ${{ steps.npm_version_output.outputs.NPM_VERSION }}
      npm_tag: ${{ steps.npm_version_output.outputs.NPM_TAG }}
      is_release: ${{ steps.npm_version_output.outputs.IS_RELEASE }}

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          egress-policy: audit

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22.14.0
          registry-url: "https://registry.npmjs.org"

      - name: Setup
        run: npm i --ignore-scripts --legacy-peer-deps --no-package-lock

      - name: Get Current Version
        run: |
          NPM_VERSION=$(node -e "console.log(require('./package.json').version);")
          echo NPM_VERSION=$NPM_VERSION >> $GITHUB_ENV

      - name: Bump, commit and tag stable release (manual dispatch)
        if: ${{ github.event_name == 'workflow_dispatch' && inputs.release_type != '' && inputs.release_type != 'dev' }}
        env:
          # env indirection keeps the free-text dispatch input out of shell interpolation
          RELEASE_INPUT: ${{ inputs.release_type }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          # npm version accepts a semver keyword (patch/minor/major) or an explicit
          # version; strip an optional leading "v" so v9.1.0 and 9.1.0 both work.
          npm version "${RELEASE_INPUT#v}" -m "chore: release v%s"
          NPM_VERSION=$(node -e "console.log(require('./package.json').version);")
          echo NPM_VERSION=$NPM_VERSION >> $GITHUB_ENV
          git push origin HEAD:${GITHUB_REF_NAME} --follow-tags

      - name: Bump version for dev release
        if: ${{ !contains(github.ref, 'refs/tags/') && (github.event_name != 'workflow_dispatch' || inputs.release_type == '' || inputs.release_type == 'dev') }}
        env:
          NPM_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.release_type == 'dev' && 'dev' || 'next' }}
        run: |
          NPM_VERSION=$(node ./scripts/get-next-version.js)
          echo NPM_VERSION=$NPM_VERSION >> $GITHUB_ENV
          npm version $NPM_VERSION --no-git-tag-version

      - name: Output NPM Version and tag
        id: npm_version_output
        env:
          # true only for a manual dispatch that cut a real (bumped) release — not
          # the empty "next" build or the "dev" channel. Computed in the GitHub
          # expression context so the free-text input never reaches the shell.
          IS_DISPATCH_RELEASE: ${{ github.event_name == 'workflow_dispatch' && inputs.release_type != '' && inputs.release_type != 'dev' }}
        run: |
          NPM_TAG=$(node ./scripts/get-npm-tag.js)
          if [[ "${GITHUB_REF}" == refs/tags/* ]] || [[ "$IS_DISPATCH_RELEASE" == "true" ]]; then
            IS_RELEASE=true
          else
            IS_RELEASE=false
          fi
          echo NPM_VERSION=$NPM_VERSION >> $GITHUB_OUTPUT
          echo NPM_TAG=$NPM_TAG >> $GITHUB_OUTPUT
          echo IS_RELEASE=$IS_RELEASE >> $GITHUB_OUTPUT

      - name: Check analytics is configured
        env:
          GA_API_SECRET: ${{ secrets.GA_API_SECRET }}
        run: |
          if [ -z "$GA_API_SECRET" ]; then
            echo "::warning::GA_API_SECRET is not set, so this release reports no analytics."
          fi

      - name: Build nativescript
        env:
          GA_API_SECRET: ${{ secrets.GA_API_SECRET }}
        run: npm run pack.release

      - name: Upload npm package artifact
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: npm-package
          path: nativescript-${{steps.npm_version_output.outputs.NPM_VERSION}}.tgz

  publish:
    runs-on: ubuntu-latest
    environment: npm-publish
    needs:
      - build
    permissions:
      contents: read
      id-token: write
    env:
      NPM_VERSION: ${{needs.build.outputs.npm_version}}
      NPM_TAG: ${{needs.build.outputs.npm_tag}}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          egress-policy: audit

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22.14.0
          registry-url: "https://registry.npmjs.org"

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: npm-package
          path: dist

      - name: Update npm (required for OIDC trusted publishing)
        run: |
          npm install -g npm@^11.5.1
          npm --version

      - name: Publish package (OIDC trusted publishing)
        if: ${{ vars.USE_NPM_TOKEN != 'true' }}
        run: |
          echo "Publishing nativescript@$NPM_VERSION to NPM with tag $NPM_TAG via OIDC trusted publishing..."
          unset NODE_AUTH_TOKEN
          if [ -n "${NPM_CONFIG_USERCONFIG:-}" ]; then
            rm -f "$NPM_CONFIG_USERCONFIG"
          fi
          npm publish ./dist/nativescript-${{env.NPM_VERSION}}.tgz --tag $NPM_TAG --access public --provenance
        env:
          NODE_AUTH_TOKEN: ""

      - name: Publish package (granular token)
        if: ${{ vars.USE_NPM_TOKEN == 'true' }}
        run: |
          echo "Publishing nativescript@$NPM_VERSION to NPM with tag $NPM_TAG via granular token..."
          npm publish ./dist/nativescript-${{env.NPM_VERSION}}.tgz --tag $NPM_TAG --access public --provenance
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}

  github-release:
    runs-on: ubuntu-latest
    # runs for tag pushes and for manual dispatches that bumped a stable release
    if: ${{ needs.build.outputs.is_release == 'true' }}
    permissions:
      contents: write
    needs:
      - build
    env:
      NPM_VERSION: ${{needs.build.outputs.npm_version}}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          egress-policy: audit

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          ref: v${{needs.build.outputs.npm_version}}

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22.14.0

      - name: Setup
        run: npm i --ignore-scripts --legacy-peer-deps --no-package-lock

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: npm-package
          path: dist

      - name: Generate provenance statement
        run: |
          TGZ_PATH=$(ls dist/nativescript-*.tgz | head -n1)
          TGZ_NAME=$(basename "$TGZ_PATH")
          TGZ_SHA=$(sha256sum "$TGZ_PATH" | awk '{ print $1 }')
          PROV_PATH="dist/${TGZ_NAME%.tgz}.intoto.jsonl"

          cat > "$PROV_PATH" <<EOF
          {"_type":"https://in-toto.io/Statement/v1","subject":[{"name":"$TGZ_NAME","digest":{"sha256":"$TGZ_SHA"}}],"predicateType":"https://slsa.dev/provenance/v1"}
          EOF

      - name: Partial Changelog
        run: npx conventional-changelog -p angular -r2 > body.md

      - uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
        with:
          tag: v${{needs.build.outputs.npm_version}}
          artifacts: "dist/nativescript-*.tgz,dist/nativescript-*.intoto.jsonl"
          bodyFile: "body.md"
          prerelease: ${{needs.build.outputs.npm_tag != 'latest'}}
          allowUpdates: true