name: Publish (forge)

# Datacenter-side forge publish, moved off the laptop: an 87MB tarball PUT
# over the laptop's WAN times out; the forge's own runner does it in seconds.
# scripts/release.sh tags + pushes, then polls this workflow's result (npm
# view against the forge registry) before it ever touches the npmjs leg —
# see the "delegation contract" in scripts/release.sh's forge-publish step.

on:
  push:
    tags:
      - 'v*'

jobs:
  publish:
    name: Publish to the forge registry
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: npm
      - run: npm ci
      - run: npm run build
      - name: Publish + readback-verify on the forge registry
        env:
          FORGE_NPM_TOKEN: ${{ secrets.FORGE_NPM_TOKEN }}
        run: |
          set -eo pipefail

          FORGE_NPM_REG="https://source.soulcraft.com/api/packages/soulcraft/npm/"
          VERSION="$(node -p "require('./package.json').version")"
          echo "Publishing @soulcraft/brainy@${VERSION} to the forge registry..."

          TMPRC="$(mktemp)"
          chmod 600 "$TMPRC"
          {
            echo "@soulcraft:registry=${FORGE_NPM_REG}"
            echo "//source.soulcraft.com/api/packages/soulcraft/npm/:_authToken=${FORGE_NPM_TOKEN}"
          } > "$TMPRC"

          # The release script bumps package.json's version before it tags, so
          # this tag's checkout already carries the version being published —
          # nothing here re-derives it from the tag name.
          PUBLISH_OK=true
          if ! npm publish --tag latest --userconfig "$TMPRC"; then
            PUBLISH_OK=false
          fi

          # Readback verify is the source of truth, run regardless of the publish
          # exit code: a benign duplicate publish (a prior run, or a mirror, already
          # landed this exact version) reports failure even though the registry
          # already holds the right content.
          LANDED_VERSION="$(npm view "@soulcraft/brainy@${VERSION}" version --userconfig "$TMPRC" 2>/dev/null || echo "")"
          rm -f "$TMPRC"

          if [ "$LANDED_VERSION" != "$VERSION" ]; then
            echo "::error::Readback verify FAILED — the forge registry reports version '${LANDED_VERSION:-<none>}', expected '${VERSION}'. This is a genuine publish failure, not a benign duplicate."
            exit 1
          fi

          if [ "$PUBLISH_OK" = true ]; then
            echo "Published and verified @soulcraft/brainy@${VERSION} on the forge registry."
          else
            echo "::warning::npm publish reported failure, but readback confirms @soulcraft/brainy@${VERSION} is already live on the forge (a prior run or mirror landed it) — treating this run as successful, since the registry content is correct. Any OTHER failure mode would have failed the readback check above instead."
          fi