# Publish npm package `init-antd-admin` from packages/create
#
# Setup (one-time):
#   1. npmjs.com → Access Tokens → Granular or Automation token with publish rights
#   2. Repo → Settings → Secrets and variables → Actions → New repository secret
#      Name: NPM_TOKEN   Value: <token>
#
# Release:
#   A) Manual: Actions → "Publish init-antd-admin" → Run workflow
#   B) Tag:     git tag init-antd-admin-v1.0.3 && git push origin init-antd-admin-v1.0.3
#               (tag suffix must match packages/create/package.json "version")

name: Publish init-antd-admin

on:
  workflow_dispatch:
  push:
    tags:
      - "init-antd-admin-v*"

permissions:
  contents: read
  id-token: write

concurrency:
  group: publish-init-antd-admin
  cancel-in-progress: true

jobs:
  publish:
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10.33.2

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          registry-url: "https://registry.npmjs.org"
          cache: "pnpm"
          cache-dependency-path: pnpm-lock.yaml

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Test init-antd-admin
        run: pnpm test
        working-directory: packages/create

      - name: Build init-antd-admin
        run: pnpm run build
        working-directory: packages/create

      - name: Publish to npm
        # Provenance only in CI (OIDC). publishConfig must not force provenance or local npm publish fails.
        run: npm publish --access public --provenance
        working-directory: packages/create
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}