publish-cli.yml

name: publish-cli

on:
  push:
    branches: [main]
    paths:
      - 'packages/cli/**'

permissions:
  contents: read

# A newer push waits for the running publish rather than racing its version check.
concurrency:
  group: publish-cli-${{ github.ref }}
  cancel-in-progress: false

jobs:
  build:
    name: build
    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
    timeout-minutes: 15
    outputs:
      version: ${{ steps.package_version.outputs.version }}
      exists: ${{ steps.version_check.outputs.exists }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
        with:
          persist-credentials: false

      - name: Setup workspace
        uses: ./.github/actions/setup
        with:
          provider: ${{ vars.CI_PROVIDER }}
          node-version: '22'

      - name: Build package
        working-directory: packages/cli
        run: bun run build

      - name: Get package version
        id: package_version
        working-directory: packages/cli
        run: echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT"

      - name: Check if version already exists
        id: version_check
        env:
          VERSION: ${{ steps.package_version.outputs.version }}
        run: |
          if npm view "simstudio@$VERSION" version &> /dev/null; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
          fi

      # Bun packs because it rewrites `workspace:` ranges to real versions,
      # which `npm pack` would publish verbatim.
      - name: Pack package
        if: steps.version_check.outputs.exists == 'false'
        working-directory: packages/cli
        run: bun pm pack --ignore-scripts --filename "$RUNNER_TEMP/package.tgz" --quiet

      - name: Upload package
        if: steps.version_check.outputs.exists == 'false'
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: package
          path: ${{ runner.temp }}/package.tgz
          if-no-files-found: error
          retention-days: 1

      - name: Log skipped publish
        if: steps.version_check.outputs.exists == 'true'
        env:
          VERSION: ${{ steps.package_version.outputs.version }}
        run: echo "Skipped publishing because version $VERSION already exists on npm"

  # npm trusted publishing trades this job's OIDC token for a short-lived npm
  # credential, so no npm token is stored anywhere. npm accepts the token only
  # from GitHub-hosted runners, and only this job can mint one: it runs no
  # repository code, it publishes the tarball the build job packed. npm runs no
  # lifecycle scripts for a tarball, so nothing is rebuilt here, and provenance
  # is attached automatically.
  publish:
    name: publish
    needs: build
    if: needs.build.outputs.exists == 'false'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      id-token: write
    steps:
      # Node 24 bundles npm 11.5.1+, which trusted publishing requires.
      - name: Setup Node
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
        with:
          node-version: '24'

      - name: Download package
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: package
          path: ${{ runner.temp }}

      - name: Publish to npm
        run: npm publish "$RUNNER_TEMP/package.tgz" --access public