tkmind_go/.github/workflows/publish-npm.yml

name: Publish to npm

# Security: This workflow uses the 'npm-production-publishing' environment to protect against
# accidental publishes from feature branches. The environment must be configured in
# GitHub Settings → Environments with:
#   - Deployment branches: Selected branches → main
#   - Environment secret: NPM_PUBLISH_TOKEN (npm publish token with write access)
#
# This ensures that even if the workflow file is modified on a feature branch to
# bypass the ref checks, GitHub will block access to the NPM_PUBLISH_TOKEN secret.

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      dry-run:
        description: 'Dry run (skip actual npm publish)'
        required: false
        type: boolean
        default: true

concurrency: ${{ github.workflow }}-${{ github.ref }}

permissions:
  contents: write
  pull-requests: write
  id-token: write  # Required for npm provenance

jobs:
  build-native:
    name: Build native binaries
    uses: ./.github/workflows/build-native-packages.yml

  release:
    name: Release
    runs-on: ubuntu-latest
    needs: build-native
    environment:
      name: npm-production-publishing
      url: https://www.npmjs.com/org/block
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: '20'
          registry-url: 'https://registry.npmjs.org'

      - name: Setup pnpm
        uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4
        with:
          version: 9

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # v2

      - name: Download native binaries
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: ${{ needs.build-native.outputs.artifact-name }}
          path: native-binaries

      - name: List downloaded artifacts (debug)
        run: |
          echo "Downloaded artifact structure:"
          ls -R native-binaries/

      - name: Copy binaries to package directories
        run: |
          for platform_dir in native-binaries/goose-acp-server-*; do
            platform=$(basename "$platform_dir")
            pkg_dir="ui/goose-acp-server/${platform}"
            
            echo "Copying binaries for ${platform}..."
            mkdir -p "${pkg_dir}/bin"
            cp -v "${platform_dir}/bin/"* "${pkg_dir}/bin/"
            chmod +x "${pkg_dir}/bin/"*
          done

          echo ""
          echo "Verification - copied binaries:"
          ls -lh ui/goose-acp-server/*/bin/

      - name: Install dependencies
        run: |
          cd ui
          pnpm install --frozen-lockfile

      - name: Build packages
        run: |
          cd ui/acp
          pnpm run build
          
          cd ../text
          pnpm run build

      - name: Dry run summary
        if: inputs.dry-run == true || github.ref != 'refs/heads/main'
        run: |
          echo "## 🧪 Dry Run Mode" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "✅ Native binaries downloaded and copied successfully" >> $GITHUB_STEP_SUMMARY
          echo "✅ Packages built successfully" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          if [ "${{ github.ref }}" != "refs/heads/main" ]; then
            echo "⚠️  Skipping actual npm publish (not on main branch)" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "**Current branch:** \`${{ github.ref }}\`" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "Publishing is only allowed from the \`main\` branch for security." >> $GITHUB_STEP_SUMMARY
          else
            echo "⚠️  Skipping actual npm publish (dry-run mode)" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "To publish for real, run this workflow without dry-run enabled." >> $GITHUB_STEP_SUMMARY
          fi

      - name: Create Release Pull Request or Publish to npm
        if: inputs.dry-run != true && github.ref == 'refs/heads/main'
        id: changesets
        uses: changesets/action@6d3568c53fbe1db6c1f9ab1c7fbf9092bc18627f # v1
        with:
          publish: pnpm run release
          version: pnpm run version
          commit: 'chore: version packages'
          title: 'chore: version packages'
          cwd: ui
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
          NPM_CONFIG_PROVENANCE: true

      - name: Summary
        if: steps.changesets.outputs.published == 'true' && inputs.dry-run != true && github.ref == 'refs/heads/main'
        run: |
          echo "## Published Packages" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo '${{ steps.changesets.outputs.publishedPackages }}' | jq -r '.[] | "- \(.name)@\(.version)"' >> $GITHUB_STEP_SUMMARY