release.yml

name: Release

# Push a version tag to publish, e.g.:
#   npm version patch -w @cordfuse/barcoding-mcp   # bump packages/mcp
#   git commit -am "release v0.0.2" && git tag v0.0.2 && git push --follow-tags
on:
  push:
    tags: ["v*"]

jobs:
  # ---- npm: @cordfuse/barcoding-mcp -------------------------------------
  publish-npm:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          registry-url: https://registry.npmjs.org
          cache: npm

      - run: npm ci

      - name: Guard — tag must match package version
        run: |
          TAG="${GITHUB_REF_NAME#v}"
          PKG="$(node -p "require('./packages/mcp/package.json').version")"
          if [ "$TAG" != "$PKG" ]; then
            echo "::error::tag v$TAG != package version $PKG"; exit 1
          fi

      - run: npm run build -w @cordfuse/barcoding-mcp

      - run: npm test -w @cordfuse/barcoding-mcp

      - name: Assert token present
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          if [ -z "$NODE_AUTH_TOKEN" ]; then
            echo "::error::NPM_TOKEN is empty in this job (secret not delivered)"; exit 1
          fi
          echo "token present, length ${#NODE_AUTH_TOKEN}"

      - name: Publish to npm
        run: npm publish -w @cordfuse/barcoding-mcp --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

  # ---- GHCR: ghcr.io/cordfuse/barcoding-mcp ----------------------------
  publish-ghcr:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Resolve version
        id: v
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: docker/Dockerfile
          push: true
          tags: |
            ghcr.io/${{ github.repository }}:${{ steps.v.outputs.version }}
            ghcr.io/${{ github.repository }}:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max