release.yml

name: Publish Package

on:
  push:
    tags:
      - 'v*'

permissions: {}

jobs:
  build:
    name: Build and inspect package
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      version: ${{ steps.version.outputs.version }}
    env:
      TAG: ${{ github.ref_name }}
      COMMIT_SHA: ${{ github.sha }}
    steps:
      - name: Validate tag format
        run: |
          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then
            echo "Error: '$TAG' is not a strict semver release tag"
            exit 1
          fi

      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Verify tag is on main
        run: |
          git fetch origin main
          git merge-base --is-ancestor "$COMMIT_SHA" origin/main || {
            echo "Error: release tags must point to a commit on main"
            exit 1
          }

      - name: Setup pnpm
        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22.14.0'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Verify package version
        id: version
        run: |
          VERSION="${TAG#v}"
          PACKAGE_VERSION=$(node -p "require('./package.json').version")
          test "$VERSION" = "$PACKAGE_VERSION" || {
            echo "Error: tag $TAG does not match package.json $PACKAGE_VERSION"
            exit 1
          }
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Build and test
        run: |
          pnpm build
          pnpm test

      - name: Pack and inspect publish contents
        run: |
          mkdir -p "$RUNNER_TEMP/package"
          npm pack --json --pack-destination "$RUNNER_TEMP/package" > "$RUNNER_TEMP/pack.json"
          PACK_JSON="$RUNNER_TEMP/pack.json" node <<'NODE'
          const fs = require('node:fs')
          const reports = JSON.parse(fs.readFileSync(process.env.PACK_JSON, 'utf8'))
          if (reports.length !== 1) throw new Error(`Expected one tarball, got ${reports.length}`)
          const forbidden = reports[0].files
            .map(({ path }) => path)
            .filter((path) => /(^|\/)(\.env|.*\.(pem|key|p12|pfx))$/i.test(path))
          if (forbidden.length) throw new Error(`Sensitive files in package: ${forbidden.join(', ')}`)
          console.log(reports[0].files.map(({ path }) => path).join('\n'))
          NODE

      - name: Upload immutable package candidate
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: npm-package
          path: ${{ runner.temp }}/package/*.tgz
          if-no-files-found: error
          retention-days: 7

  publish:
    name: Publish approved tarball
    needs: build
    runs-on: ubuntu-latest
    environment: npm-publish
    permissions:
      contents: read
      id-token: write
    env:
      EXPECTED_NAME: '@formo/analytics'
      EXPECTED_VERSION: ${{ needs.build.outputs.version }}
    steps:
      - name: Download package candidate
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: npm-package
          path: package

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22.14.0'
          package-manager-cache: false

      - name: Install exact npm publishing client
        run: npm install --global npm@11.18.0

      - name: Verify tarball identity and lifecycle hooks
        run: |
          mapfile -t TARBALLS < <(find "$PWD/package" -maxdepth 1 -name '*.tgz' -type f)
          test "${#TARBALLS[@]}" -eq 1 || { echo "Expected exactly one tarball"; exit 1; }
          mkdir inspect
          tar -xzf "${TARBALLS[0]}" -C inspect
          PACKAGE_JSON=inspect/package/package.json node <<'NODE'
          const fs = require('node:fs')
          const pkg = JSON.parse(fs.readFileSync(process.env.PACKAGE_JSON, 'utf8'))
          if (pkg.name !== process.env.EXPECTED_NAME) throw new Error(`Unexpected package: ${pkg.name}`)
          if (pkg.version !== process.env.EXPECTED_VERSION) throw new Error(`Unexpected version: ${pkg.version}`)
          for (const hook of ['preinstall', 'install', 'postinstall']) {
            if (pkg.scripts?.[hook]) throw new Error(`Forbidden lifecycle hook: ${hook}`)
          }
          NODE
          test ! -f inspect/package/binding.gyp || { echo "Forbidden implicit install hook: binding.gyp"; exit 1; }
          echo "tarball=${TARBALLS[0]}" >> "$GITHUB_ENV"

      - name: Publish with OIDC provenance
        run: npm publish "$tarball" --provenance --access public

  release:
    name: Create GitHub release
    needs: [build, publish]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    env:
      TAG: ${{ github.ref_name }}
      VERSION: ${{ needs.build.outputs.version }}
      GH_TOKEN: ${{ github.token }}
      GH_REPO: ${{ github.repository }}
    steps:
      - name: Create release notes
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
        with:
          generate_release_notes: true

      - name: Add CDN integrity hash
        run: |
          sleep 30
          URL="https://cdn.formo.so/analytics@$VERSION"
          HASH=$(curl --fail --silent --show-error --location --compressed "$URL" | openssl dgst -sha384 -binary | openssl base64 -A)
          gh release view "$TAG" --json body --jq .body > release-notes.md
          cat >> release-notes.md <<EOF

          ## CDN

          \`\`\`html
          <script src="$URL" integrity="sha384-$HASH" crossorigin="anonymous"></script>
          \`\`\`
          EOF
          gh release edit "$TAG" --notes-file release-notes.md