release-npm.yml

name: Release npm - Publish npm Package

on:
  workflow_call:
    inputs:
      version:
        description: 'Release version tag (e.g., vX.Y.Z). Must start with "v".'
        required: true
        type: string
    outputs:
      release_name:
        description: 'The release name without "v" prefix (e.g., X.Y.Z)'
        value: ${{ jobs.publish-npm.outputs.release_name }}
      version:
        description: 'The full version string with "v" prefix (e.g., vX.Y.Z)'
        value: ${{ jobs.publish-npm.outputs.version }}
  workflow_dispatch:
    inputs:
      version:
        description: 'Release version tag (e.g., vX.Y.Z). Must start with "v". Tag must already exist.'
        required: true
        type: string

permissions:
  contents: read

jobs:
  publish-npm:
    name: Publish npm Package
    runs-on: ubuntu-latest

    environment: release-npm

    permissions:
      contents: read
      packages: write

    outputs:
      release_name: ${{ steps.version.outputs.release_name }}
      version: ${{ steps.version.outputs.version }}

    steps:
      - name: npm - Validate and parse version
        id: version
        run: |
          VERSION="${{ inputs.version }}"
          if [[ ! "${VERSION}" =~ ^v ]]; then
            echo "::error::Version '${VERSION}' must start with 'v'"
            exit 1
          fi
          echo "version=${VERSION}" >> $GITHUB_OUTPUT
          echo "release_name=${VERSION#v}" >> $GITHUB_OUTPUT

      - name: npm - Checkout tag
        uses: actions/checkout@v6
        with:
          ref: refs/tags/${{ steps.version.outputs.version }}

      - name: npm - Setup Node.js
        uses: actions/setup-node@v6
        with:
          cache: 'npm'
          node-version-file: '.node-version'
          registry-url: 'https://npm.pkg.github.com'
          scope: '@advanced-security'

      - name: npm - Install dependencies
        run: npm ci --include=optional

      - name: npm - Build server
        run: npm run build -w server

      - name: npm - Publish npm package
        working-directory: server
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "Publishing @advanced-security/codeql-development-mcp-server to GitHub Packages..."
          npm publish
          echo "✅ Published npm package to GitHub Packages"

      - name: npm - Upload release build artifact
        uses: actions/upload-artifact@v6
        with:
          name: release-build-${{ steps.version.outputs.version }}
          path: |
            .node-version
            server/dist/
            server/ql/
            server/package.json
            README.md
            LICENSE
            docs/

      - name: npm - Summary
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          RELEASE_NAME="${{ steps.version.outputs.release_name }}"
          echo "## npm Package Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Detail | Value |" >> $GITHUB_STEP_SUMMARY
          echo "| ------ | ----- |" >> $GITHUB_STEP_SUMMARY
          echo "| Package | \`@advanced-security/codeql-development-mcp-server\` |" >> $GITHUB_STEP_SUMMARY
          echo "| Version | ${RELEASE_NAME} |" >> $GITHUB_STEP_SUMMARY
          echo "| Registry | GitHub Packages |" >> $GITHUB_STEP_SUMMARY
          echo "| Tag | ${VERSION} |" >> $GITHUB_STEP_SUMMARY