packages.yml

name: Packages to NPM

on:
  push:
    branches:
      - develop

# The one workflow here that queues rather than cancels. Deploys are idempotent — a
# cancelled one is re-applied in full by the run that superseded it — but publishing is
# not: interrupting a multi-package publish leaves the set half-released, and npm will
# not accept the same version twice, so there is no way to re-run into a clean state.
# Queuing also keeps two pushes from racing to publish the same version.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  id-token: write
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Determine base commit
        id: diff_base
        run: |
          BEFORE_SHA="${{ github.event.before }}"
          if [ -n "$BEFORE_SHA" ] && [ "$BEFORE_SHA" != "0000000000000000000000000000000000000000" ]; then
            BASE="$BEFORE_SHA"
          else
            BASE=$(git rev-list --max-parents=0 HEAD)
          fi
          echo "base=$BASE" >> "$GITHUB_OUTPUT"

      - name: Detect version bump in @ecency/sdk
        id: detect_sdk
        run: |
          BASE="${{ steps.diff_base.outputs.base }}"
          FILE="packages/sdk/package.json"
          node - <<'NODE' >> "$GITHUB_OUTPUT"
          const { execSync } = require("child_process");
          const fs = require("fs");
          const base = process.env.BASE;
          const file = process.env.FILE;
          const headVersion = JSON.parse(fs.readFileSync(file, "utf8")).version;
          let baseVersion = null;
          try {
            const out = execSync(`git show ${base}:${file}`, { encoding: "utf8" });
            baseVersion = JSON.parse(out).version;
          } catch (error) {
            baseVersion = null;
          }
          const changed = baseVersion !== headVersion;
          process.stdout.write(`changed=${changed ? "true" : "false"}\n`);
          NODE
        env:
          BASE: ${{ steps.diff_base.outputs.base }}
          FILE: packages/sdk/package.json

      - name: Detect version bump in @ecency/wallets
        id: detect_wallets
        run: |
          BASE="${{ steps.diff_base.outputs.base }}"
          FILE="packages/wallets/package.json"
          node - <<'NODE' >> "$GITHUB_OUTPUT"
          const { execSync } = require("child_process");
          const fs = require("fs");
          const base = process.env.BASE;
          const file = process.env.FILE;
          const headVersion = JSON.parse(fs.readFileSync(file, "utf8")).version;
          let baseVersion = null;
          try {
            const out = execSync(`git show ${base}:${file}`, { encoding: "utf8" });
            baseVersion = JSON.parse(out).version;
          } catch (error) {
            baseVersion = null;
          }
          const changed = baseVersion !== headVersion;
          process.stdout.write(`changed=${changed ? "true" : "false"}\n`);
          NODE
        env:
          BASE: ${{ steps.diff_base.outputs.base }}
          FILE: packages/wallets/package.json

      - name: Detect version bump in @ecency/render-helper
        id: detect_render_helper
        run: |
          BASE="${{ steps.diff_base.outputs.base }}"
          FILE="packages/render-helper/package.json"
          node - <<'NODE' >> "$GITHUB_OUTPUT"
          const { execSync } = require("child_process");
          const fs = require("fs");
          const base = process.env.BASE;
          const file = process.env.FILE;
          const headVersion = JSON.parse(fs.readFileSync(file, "utf8")).version;
          let baseVersion = null;
          try {
            const out = execSync(`git show ${base}:${file}`, { encoding: "utf8" });
            baseVersion = JSON.parse(out).version;
          } catch (error) {
            baseVersion = null;
          }
          const changed = baseVersion !== headVersion;
          process.stdout.write(`changed=${changed ? "true" : "false"}\n`);
          NODE
        env:
          BASE: ${{ steps.diff_base.outputs.base }}
          FILE: packages/render-helper/package.json

      - name: Detect version bump in @ecency/ui
        id: detect_ui
        run: |
          BASE="${{ steps.diff_base.outputs.base }}"
          FILE="packages/ui/package.json"
          node - <<'NODE' >> "$GITHUB_OUTPUT"
          const { execSync } = require("child_process");
          const fs = require("fs");
          const base = process.env.BASE;
          const file = process.env.FILE;
          const headVersion = JSON.parse(fs.readFileSync(file, "utf8")).version;
          let baseVersion = null;
          try {
            const out = execSync(`git show ${base}:${file}`, { encoding: "utf8" });
            baseVersion = JSON.parse(out).version;
          } catch (error) {
            baseVersion = null;
          }
          const changed = baseVersion !== headVersion;
          process.stdout.write(`changed=${changed ? "true" : "false"}\n`);
          NODE
        env:
          BASE: ${{ steps.diff_base.outputs.base }}
          FILE: packages/ui/package.json

      - name: Check if any package version changed
        id: packages_changed
        run: |
          if [ "${{ steps.detect_sdk.outputs.changed }}" = "true" ] || [ "${{ steps.detect_wallets.outputs.changed }}" = "true" ] || [ "${{ steps.detect_render_helper.outputs.changed }}" = "true" ] || [ "${{ steps.detect_ui.outputs.changed }}" = "true" ]; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
          else
            echo "changed=false" >> "$GITHUB_OUTPUT"
          fi

      - uses: pnpm/action-setup@v3
        if: steps.packages_changed.outputs.changed == 'true'
        with:
          version: 11.5.0
          run_install: false

      - uses: actions/setup-node@v4
        if: steps.packages_changed.outputs.changed == 'true'
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      - name: Use clean npm config for OIDC
        if: steps.packages_changed.outputs.changed == 'true'
        run: |
          # ensure no token auth is accidentally used
          unset NODE_AUTH_TOKEN
          unset NPM_TOKEN

          # create a minimal npmrc with NO auth token lines
          CLEAN_NPMRC="$RUNNER_TEMP/oidc.npmrc"
          echo "registry=https://registry.npmjs.org/" > "$CLEAN_NPMRC"
          echo "always-auth=false" >> "$CLEAN_NPMRC"

          echo "NPM_CONFIG_USERCONFIG=$CLEAN_NPMRC" >> $GITHUB_ENV

          echo "Using npmrc:"
          cat "$CLEAN_NPMRC"

      - name: Install dependencies
        if: steps.packages_changed.outputs.changed == 'true'
        run: pnpm install --frozen-lockfile
        env:
          VITE_HELIUS_API_KEY: ${{ secrets.VITE_HELIUS_API_KEY }}

      - name: Build @ecency/sdk
        if: steps.detect_sdk.outputs.changed == 'true'
        run: pnpm --filter @ecency/sdk build
        env:
          VITE_HELIUS_API_KEY: ${{ secrets.VITE_HELIUS_API_KEY }}

      - name: Build @ecency/wallets
        if: steps.detect_wallets.outputs.changed == 'true'
        run: pnpm --filter @ecency/wallets build
        env:
          VITE_HELIUS_API_KEY: ${{ secrets.VITE_HELIUS_API_KEY }}

      - name: Build @ecency/render-helper
        if: steps.detect_render_helper.outputs.changed == 'true'
        run: pnpm --filter @ecency/render-helper build

      - name: Build @ecency/ui
        if: steps.detect_ui.outputs.changed == 'true'
        run: pnpm --filter @ecency/ui build

      - name: Debug npm versions
        run: |
          node -v
          npm -v
          npx -y npm@latest -v

      - name: Publish @ecency/sdk
        if: steps.detect_sdk.outputs.changed == 'true'
        env:
          PNPM_CONFIG_GIT_CHECKS: "false"
        run: pnpm publish:sdk

      - name: Publish @ecency/wallets
        if: steps.detect_wallets.outputs.changed == 'true'
        env:
          PNPM_CONFIG_GIT_CHECKS: "false"
        run: pnpm publish:wallets

      - name: Publish @ecency/render-helper
        if: steps.detect_render_helper.outputs.changed == 'true'
        env:
          PNPM_CONFIG_GIT_CHECKS: "false"
        run: pnpm publish:render-helper

      - name: Publish @ecency/ui
        if: steps.detect_ui.outputs.changed == 'true'
        env:
          PNPM_CONFIG_GIT_CHECKS: "false"
        run: pnpm publish:ui