standardnotes-app/.github/workflows/publish.from-git.yml

name: Publish Tagged Release to NPM

on:
  workflow_dispatch:
    inputs:
      release_commit:
        description: 'Commit SHA with release tags (leave empty to use the latest chore(release): publish on main)'
        required: false
        type: string

permissions:
  id-token: write

jobs:
  publish-from-git-tags:
    name: Publish to NPM from Git Tags
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
        with:
          token: ${{ secrets.CI_PAT_TOKEN }}
          ref: main
          fetch-depth: 0

      - name: Resolve release commit
        id: release-commit
        run: |
          if [ -n "${{ inputs.release_commit }}" ]; then
            COMMIT="${{ inputs.release_commit }}"
          else
            COMMIT="$(git log main --grep='chore(release): publish' -n 1 --format=%H)"
          fi

          if [ -z "$COMMIT" ]; then
            echo "No release commit found on main."
            exit 1
          fi

          if ! git cat-file -e "${COMMIT}^{commit}" 2>/dev/null; then
            echo "Commit ${COMMIT} does not exist."
            exit 1
          fi

          TAG_COUNT="$(git tag --points-at "$COMMIT" | wc -l | tr -d ' ')"
          if [ "$TAG_COUNT" -eq 0 ]; then
            echo "Commit ${COMMIT} has no release tags."
            exit 1
          fi

          echo "commit=${COMMIT}" >> "$GITHUB_OUTPUT"
          echo "Using release commit ${COMMIT}"
          git tag --points-at "$COMMIT"

      - name: Checkout release commit
        run: git checkout "${{ steps.release-commit.outputs.commit }}"

      - name: Set up Node
        uses: actions/setup-node@v3
        with:
          registry-url: 'https://registry.npmjs.org'
          node-version-file: '.nvmrc'
          cache: 'yarn'

      - name: Upgrade npm (trusted publishing requirement)
        run: npm install -g npm@^11.5.1

      - name: Enable Corepack (Yarn)
        run: corepack enable

      - name: Install dependencies
        run: yarn install --immutable

      - name: Build
        run: yarn build:all

      - name: Publish tagged packages
        run: yarn publish:prod