cd.yml

name: CD

on:
  push:
    branches:
      - stable

permissions:
  # `lerna version` pushes the release commit and tags and creates the GitHub release,
  # so the token needs write access to contents. id-token is for npm provenance.
  contents: write
  id-token: write

jobs:
  build:
    name: Build, Test, and Deploy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          fetch-depth: 0
      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
        with:
          node-version: 20
          registry-url: 'https://registry.npmjs.org'
          scope: '@ionic'
      - name: 🔒 Configure Identity
        run: |
          git config user.name github-actions
          git config user.email github-actions@github.com
      # npm 12 requires Node >=22.22.2, so `npm@latest` cannot run on the Node 20 pinned
      # above. npm 11 is the newest line that does, and it supports both provenance and
      # OIDC trusted publishing.
      - name: 🟢 Ensure Supported npm
        run: npm install -g npm@11
        shell: bash
      - name: 📦 Install Dependencies
        run: npm ci --no-package-lock
        shell: bash
      - name: 🔄 Bootstrap
        run: npm run bootstrap -- --ignore-scripts
        shell: bash
      - name: 🔖 Version
        run: npm run version:ci
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      # `lerna publish` uploads via libnpmpublish@4, which supports neither provenance nor
      # OIDC trusted publishing, so the upload goes through the npm CLI instead.
      #
      # NODE_AUTH_TOKEN is cleared on purpose. `setup-node` exports the placeholder
      # `XXXXX-XXXXX-XXXXX-XXXXX` when given no token, and the .npmrc it writes points
      # `_authToken` at that variable, so npm sends the placeholder as a real credential
      # and never attempts the OIDC exchange. The registry masks the rejection as E404.
      # With no credential configured, npm falls back to trusted publishing.
      - name: 🚀 Publish
        run: npm run publish:ci
        shell: bash
        env:
          NODE_AUTH_TOKEN: ''
          # npm logs every OIDC token-exchange failure at verbose, so at the default
          # loglevel a missing or mismatched trusted publisher just surfaces as
          # ENEEDAUTH with no reason attached.
          NPM_CONFIG_LOGLEVEL: verbose