ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  commitlint:
    name: Commitlint
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - uses: wagoid/commitlint-github-action@v6

  lint:
    name: Lint
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm lint

  typecheck:
    name: Typecheck
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm typecheck

  test:
    name: Test
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      code-quality: write
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm test:coverage
      - name: Upload coverage report
        # GitHub Code Quality requires the org on Team/Enterprise Cloud (ExaDev is currently Free), so this no-ops until the org upgrades -- fail-on-error: false keeps that from blocking release, which depends on this job succeeding.
        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
        uses: actions/upload-code-coverage@v1
        with:
          file: coverage/cobertura-coverage.xml
          language: typescript
          label: unit
          fail-on-error: false

  test-smoke:
    name: Smoke test
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm test:smoke

  release:
    name: Release
    needs: [commitlint, lint, typecheck, test, test-smoke]
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: write # to push the release commit/tag and create the GitHub Release
      issues: write # to comment on released issues
      pull-requests: write # to comment on released pull requests
      id-token: write # OIDC identity for npm trusted publishing (no NPM_TOKEN)
    outputs:
      published: ${{ steps.before.outputs.version != steps.after.outputs.version }}
      version: ${{ steps.after.outputs.version }}
    steps:
      - uses: actions/checkout@v7
        with:
          # semantic-release analyses the full commit history since the last release.
          fetch-depth: 0
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: pnpm
          # registry-url is deliberately absent. Setting it makes setup-node write an .npmrc containing an _authToken line, and that line wins over the OIDC token exchange -- so the setting that looks like it configures the registry is exactly the one that would stop trusted publishing working.
      - run: pnpm install --frozen-lockfile
      - name: Read pre-release version
        id: before
        run: echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT"
      - name: Upgrade npm for OIDC trusted publishing (needs npm CLI >=11.5.1)
        run: npm install -g npm@latest
      - name: Release
        # HUSKY=0 so the commit-msg hook never fires against the automated release commit.
        run: HUSKY=0 pnpm exec semantic-release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Blanked, not omitted -- an inherited NPM_TOKEN/NODE_AUTH_TOKEN from a workflow-level env block, reusable workflow, or composite action would otherwise be used in preference to the OIDC exchange.
          NPM_TOKEN: ''
          NODE_AUTH_TOKEN: ''
      - name: Read post-release version
        id: after
        run: echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT"

  publish-aliases:
    name: Publish aliases (${{ matrix.name }})
    needs: release
    if: needs.release.outputs.published == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      id-token: write # OIDC identity for npm trusted publishing.
    strategy:
      fail-fast: false
      matrix:
        include:
          - { name: doculi, registry: 'https://registry.npmjs.org' }
    steps:
      - uses: actions/checkout@v7
        with:
          ref: main # the release commit semantic-release just pushed
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: pnpm
          # registry-url is deliberately absent -- see release job's own comment for why.
      - run: pnpm install --frozen-lockfile
      - run: pnpm build
      - name: Rewrite package name for this alias
        # Only the top-level "name" field changes -- "bin" keeps both document-cli and doculi entries regardless, so installing either published name yields both commands.
        run: npm pkg set name="${{ matrix.name }}"
      - run: pnpm publish --access public --no-git-checks
        env:
          NODE_AUTH_TOKEN: '' # Blanked, not omitted -- see release job's own comment for why.

  attest:
    name: Attest SBOM and build provenance
    needs: release
    if: needs.release.outputs.published == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@v7
        with:
          ref: main # the release commit semantic-release just pushed
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm build
      # Pack into a directory of its own, separate from dist/ (tsdown's raw build output). The attestation subject has to be the artefact that actually ships -- attesting dist/ itself would mix in files that never leave the repo, producing digests that match nothing a consumer can download.
      - run: pnpm pack --pack-destination release-artifact
      - run: pnpm sbom --sbom-format spdx --prod > release-artifact/sbom.spdx.json
      - name: Attest SBOM
        uses: actions/attest@v4
        with:
          subject-path: release-artifact/*.tgz
          sbom-path: release-artifact/sbom.spdx.json
      - name: Attest build provenance
        uses: actions/attest@v4
        with:
          subject-path: release-artifact/*.tgz