npm-publish.yml

name: Publish Packages to NPM
on:
  push:
    branches:
      - production
    paths:
      - 'packages/sdk/**'

jobs:
  publishable-packages:
    name: Check for package that can be published
    uses: ./.github/workflows/publishable-packages.yml
    with:
      package-names: 'sdk'

  publish-sdk:
    name: Publish NPM
    needs: publishable-packages
    if: ${{ fromJson(needs.publishable-packages.outputs.publishable-packages)[0] != '' }}
    runs-on: ubuntu-latest
    # Required for provenance
    permissions:
      id-token: write
    strategy:
      matrix:
        package-name: ${{ fromJson(needs.publishable-packages.outputs.publishable-packages) }}
    steps:
      - name: Checkout code
        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b

      - name: Setup workflow
        uses: ./.github/actions/setup

      - name: Get pnpm store directory
        id: pnpm-store
        shell: bash
        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_OUTPUT

      - name: Setup pnpm cache
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9
        with:
          path: ${{ steps.pnpm-store.outputs.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install and build package
        run: |
          pnpm --filter-prod ${{ matrix.package-name }}... install
          pnpm --filter ${{ matrix.package-name }}... build

      - name: Publish package
        run: NPM_CONFIG_PROVENANCE=true pnpm --filter ${{ matrix.package-name }} publish --publish-branch production --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}