.github/workflows/build.yml

name: Build and Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'
      - run: npm ci
      - run: npm test

  build:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'
      - run: npm ci
      - run: mkdir -p bin/linux bin/macos bin/win
      - name: Build Linux executable
        run: npm run pkg-linux
      - name: Build macOS executable
        run: npm run pkg-macos
      - name: Build Windows executable
        run: npm run pkg-win
      - name: Upload Linux binary
        uses: actions/upload-artifact@v4
        with:
          name: cmc-tagger-linux-x64
          path: bin/linux/cmc-tagger
          if-no-files-found: error
      - name: Upload macOS binary
        uses: actions/upload-artifact@v4
        with:
          name: cmc-tagger-macos-x64
          path: bin/macos/cmc-tagger
          if-no-files-found: error
      - name: Upload Windows binary
        uses: actions/upload-artifact@v4
        with:
          name: cmc-tagger-win-x64
          path: bin/win/cmc-tagger.exe
          if-no-files-found: error
      - name: Create GitHub Release
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v2
        with:
          files: |
            bin/linux/cmc-tagger
            bin/macos/cmc-tagger
            bin/win/cmc-tagger.exe
          generate_release_notes: true

  publish-npm:
    needs: test
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      id-token: write   # required for npm trusted publishing (OIDC)
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
          registry-url: 'https://registry.npmjs.org'
      - run: npm install -g npm@latest   # OIDC/trusted publishing needs npm >= 11.5.1
      - run: npm ci
      - run: npm publish   # no token: authenticates via OIDC, provenance is automatic