publish-npm.yml

name: Publish Package NPM

on:
  workflow_call:
    inputs:
      scope:
        description: "NPM package scope (e.g., @iexec)"
        default: "@iexec"
        type: string
      node-version:
        description: "Node.js version to use"
        default: "20"
        type: string
      registry:
        description: "NPM registry URL"
        default: "https://registry.npmjs.org"
        type: string
      access:
        description: "Package access (public/restricted)"
        default: "public"
        type: string
      provenance:
        description: "Enable npm provenance"
        default: true
        type: boolean
      install-command:
        description: "Install dependencies command"
        default: "npm ci"
        type: string
      build-command:
        description: "Build package command"
        default: "npm run build"
        type: string
      run-tests:
        description: "Execute unit tests step"
        default: false
        type: boolean
      test-command:
        description: "Run unit tests command"
        default: "npm test --if-present"
        type: string
      lint-command:
        description: "Run linting command"
        default: "npm run lint --if-present"
        type: string
      type-check-command:
        description: "Run type-checking command"
        default: "npm run check-types --if-present"
        type: string
      format-check-command:
        description: "Run format-checking command"
        default: "npm run check-format --if-present"
        type: string
      environment:
        description: "GitHub environment"
        default: "production"
        type: string
      tag:
        description: "npm publish tag (e.g., latest, nightly)"
        default: ""
        type: string
      working-directory:
        description: "Directory containing package.json"
        default: ""
        type: string
      artifact-name:
        description: "Name of an artifact to download before the build (leave empty to skip)"
        default: ""
        type: string
      artifact-path:
        description: "Destination path for the downloaded artifact"
        default: ""
        type: string
      version:
        description: "Version to publish (leave empty to use package.json version)"
        default: ""
        type: string
      dry-run:
        description: "Run in dry-run mode (the package will not be published)"
        default: false
        type: boolean
    secrets:
      npm-token:
        description: "NPM auth token (required unless `dry-run: true` or workflow is called by a trusted publisher)"
        required: false

jobs:
  build:
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
      - name: Download extra artifact
        if: ${{ inputs.artifact-name != '' }}
        uses: actions/download-artifact@v4
        with:
          name: ${{ inputs.artifact-name }}
          path: ${{ inputs.artifact-path }}

      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ inputs.node-version }}
          registry-url: ${{ inputs.registry }}
          scope: ${{ inputs.scope }}

      - name: Ensure npm version
        if: ${{ !inputs.dry-run }}
        run: |
          if [ -n "${{ secrets.npm-token }}" ]; then
            echo "npm-token secret is set not using OIDC"
          elif [ $(npx semver -r ">=11.5.1" $(npm -v)) ]; then
            echo "OIDC trusted publishing supported by current npm version"
          else
            echo "OIDC trusted publishing requires npm >= 11.5.1, updating npm"
            npm install -g npm@11
          fi

      - name: Install dependencies
        working-directory: ${{ inputs.working-directory }}
        run: ${{ inputs.install-command }}

      - name: Override version
        if: ${{ inputs.version != '' }}
        working-directory: ${{ inputs.working-directory }}
        run: |
          npm pkg set version="${{ inputs.version }}"

      - name: Run build
        working-directory: ${{ inputs.working-directory }}
        run: ${{ inputs.build-command }}

      - name: Run type checks
        working-directory: ${{ inputs.working-directory }}
        run: ${{ inputs.type-check-command }}

      - name: check format
        working-directory: ${{ inputs.working-directory }}
        run: ${{ inputs.format-check-command }}

      - name: Run linting
        working-directory: ${{ inputs.working-directory }}
        run: ${{ inputs.lint-command }}

      - name: Run unit tests
        if: ${{ inputs.run-tests }}
        working-directory: ${{ inputs.working-directory }}
        run: ${{ inputs.test-command }}

      - name: Publish package
        working-directory: ${{ inputs.working-directory }}
        env:
          NODE_AUTH_TOKEN: ${{ secrets.npm-token }}
        run: |
          TAG_OPT=""
          if [ -n "${{ inputs.tag }}" ]; then
            TAG_OPT="--tag ${{ inputs.tag }}"
          fi

          DRY_RUN_OPT=""
          if [ "${{ inputs.dry-run }}" = "true" ]; then
            npm pkg set version=$(npm pkg get version | sed 's/"//g')-dry-run
            DRY_RUN_OPT="--dry-run --tag dry-run"
          fi

          PROVENANCE_OPT=""
          if [ "${{ inputs.provenance }}" = "true" ]; then
            PROVENANCE_OPT="--provenance"
          fi

          npm publish --access ${{ inputs.access }} $TAG_OPT $DRY_RUN_OPT $PROVENANCE_OPT