name: npm publish

permissions:
  contents: read # Required for OIDC
  id-token: write # Required for OIDC

on:
  # Only invoked from release.yml. Trusted publishing on npmjs.com validates
  # the filename of the top-level workflow of the run, and the trusted
  # publisher config names release.yml, so dispatching this workflow directly
  # would fail the OIDC exchange.
  #
  # There is deliberately no workflow_dispatch: if this job fails after a
  # successful release job, use 'Re-run failed jobs' on the release.yml run.
  # That keeps release.yml as the top-level workflow for OIDC and avoids
  # re-running the version bump.
  workflow_call:

jobs:
  publish:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    environment: prod

    steps:
      - uses: actions/checkout@v7
        with:
          ref: master
      - uses: actions/setup-node@v7
        with:
          node-version-file: .nvmrc
          package-manager-cache: false # never use caching in release builds
          registry-url: 'https://registry.npmjs.org' 
      - name: Publish Package To npmjs
        run: npm publish