self/.github/workflows/npm-publish.yml

name: NPM Publish

on:
  push:
    branches:
      - dev
    paths:
      - "sdk/core/package.json"
      - "sdk/qrcode/package.json"
      - "common/package.json"
      - "packages/mobile-sdk-alpha/package.json"
      - "sdk/qrcode-angular/package.json"
      - "contracts/package.json"
  workflow_dispatch:
    inputs:
      dry_run:
        description: "Run publish with --dry-run"
        required: false
        type: boolean
        default: false

permissions:
  id-token: write # Required for OIDC
  contents: read

jobs:
  detect-changes:
    runs-on: ubuntu-slim
    outputs:
      core_changed: ${{ steps.check-version.outputs.core_changed }}
      qrcode_changed: ${{ steps.check-version.outputs.qrcode_changed }}
      common_changed: ${{ steps.check-version.outputs.common_changed }}
      contracts_changed: ${{ steps.check-version.outputs.contracts_changed }}
      qrcode_angular_changed: ${{ steps.check-version.outputs.qrcode_angular_changed }}
      msdk_changed: ${{ steps.check-version.outputs.msdk_changed }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc

      - name: Check for version changes
        id: check-version
        run: |
          BASE_SHA="${{ github.event.before }}"
          HEAD_SHA="${{ github.sha }}"
          if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ]; then
            # Zero-before means new ref. Use the first pushed commit's parent as base.
            FIRST_PUSHED=$(node -e "
              const fs = require('fs');
              const event = JSON.parse(fs.readFileSync(process.env.GITHUB_EVENT_PATH, 'utf8'));
              const commits = event.commits || [];
              process.stdout.write(commits.length > 0 ? commits[0].id : '');
            ")
            if [ -n "$FIRST_PUSHED" ]; then
              BASE_SHA="$(git rev-parse "${FIRST_PUSHED}^" 2>/dev/null || echo "")"
            fi
          fi

          get_version() {
            git show "$1":"$2" 2>/dev/null | node -e "
              let d=''; process.stdin.on('data',c=>d+=c); process.stdin.on('end',()=>{
                try { process.stdout.write(JSON.parse(d).version||'') } catch {}
              })"
          }

          has_version_change() {
            local package_json_path="$1"
            local old_version new_version
            old_version=""
            if [ -n "$BASE_SHA" ]; then
              old_version="$(get_version "$BASE_SHA" "$package_json_path")"
            fi
            new_version="$(get_version "$HEAD_SHA" "$package_json_path")"
            [ -n "$new_version" ] && [ "$old_version" != "$new_version" ]
          }

          set_changed_output() {
            local output_name="$1"
            local package_json_path="$2"

            if [ "${{ github.event_name }}" = "workflow_dispatch" ] || has_version_change "$package_json_path"; then
              echo "${output_name}=true" >> "$GITHUB_OUTPUT"
            else
              echo "${output_name}=false" >> "$GITHUB_OUTPUT"
            fi
          }

          set_changed_output core_changed "sdk/core/package.json"
          set_changed_output qrcode_changed "sdk/qrcode/package.json"
          set_changed_output common_changed "common/package.json"
          set_changed_output contracts_changed "contracts/package.json"
          set_changed_output qrcode_angular_changed "sdk/qrcode-angular/package.json"
          set_changed_output msdk_changed "packages/mobile-sdk-alpha/package.json"

  publish-core:
    needs: detect-changes
    if: needs.detect-changes.outputs.core_changed == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          registry-url: "https://registry.npmjs.org"

      - name: Install Dependencies
        uses: ./.github/actions/yarn-install

      - name: Build package
        run: |
          yarn workspace @selfxyz/core build:deps

      - name: Check version not already published
        id: check_version
        working-directory: sdk/core
        run: |
          NAME=$(node -p "require('./package.json').name")
          VERSION=$(node -p "require('./package.json').version")
          if npm view "$NAME@$VERSION" version 2>/dev/null; then
            echo "::error::Version $VERSION of $NAME is already published on npm. Bump the version in package.json to publish."
            exit 1
          fi

      - name: "Pack with yarn (resolves workspace: protocol)"
        working-directory: sdk/core
        run: yarn pack --out package.tgz

      - name: Publish to npm
        working-directory: sdk/core
        id: publish
        run: |
          DRY_RUN="${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}"
          VERSION=$(node -p "require('./package.json').version")
          TAG=$([[ "$VERSION" == *-* ]] && echo "--tag beta" || echo "")
          npx npm@latest publish package.tgz --access public $TAG $DRY_RUN

      - name: Publish result
        if: always()
        run: |
          OUTCOME="${{ steps.publish.outcome }}"
          DRY_RUN="${{ github.event.inputs.dry_run }}"
          CHECK_OUTCOME="${{ steps.check_version.outcome }}"
          if [ "$OUTCOME" = "success" ]; then
            if [ "$DRY_RUN" = "true" ]; then
              echo "✅ Dry run completed (no package uploaded)"
            else
              echo "✅ Package published successfully"
            fi
          elif [ "$OUTCOME" = "skipped" ]; then
            if [ "$CHECK_OUTCOME" = "failure" ]; then
              echo "::warning::Publish skipped: this version is already published on npm. Bump the version in package.json to publish."
            else
              echo "::warning::Publish step was skipped (e.g. an earlier step failed)."
            fi
          else
            echo "::warning::NPM publish failed. For @selfxyz/core we use Trusted Publishers (OIDC); check workflow and npm package settings."
          fi

  publish-qrcode:
    needs: detect-changes
    if: needs.detect-changes.outputs.qrcode_changed == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          registry-url: "https://registry.npmjs.org"

      - name: Install Dependencies
        uses: ./.github/actions/yarn-install

      - name: Build package
        run: |
          yarn workspace @selfxyz/qrcode build:deps

      - name: Check version not already published
        id: check_version
        working-directory: sdk/qrcode
        run: |
          NAME=$(node -p "require('./package.json').name")
          VERSION=$(node -p "require('./package.json').version")
          if npm view "$NAME@$VERSION" version 2>/dev/null; then
            echo "::error::Version $VERSION of $NAME is already published on npm. Bump the version in package.json to publish."
            exit 1
          fi

      - name: "Pack with yarn (resolves workspace: protocol)"
        working-directory: sdk/qrcode
        run: yarn pack --out package.tgz

      - name: Publish to npm
        working-directory: sdk/qrcode
        id: publish
        run: |
          DRY_RUN="${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}"
          VERSION=$(node -p "require('./package.json').version")
          TAG=$([[ "$VERSION" == *-* ]] && echo "--tag beta" || echo "")
          npx npm@latest publish package.tgz --access public $TAG $DRY_RUN

      - name: Publish result
        if: always()
        run: |
          OUTCOME="${{ steps.publish.outcome }}"
          DRY_RUN="${{ github.event.inputs.dry_run }}"
          CHECK_OUTCOME="${{ steps.check_version.outcome }}"
          if [ "$OUTCOME" = "success" ]; then
            if [ "$DRY_RUN" = "true" ]; then
              echo "✅ Dry run completed (no package uploaded)"
            else
              echo "✅ Package published successfully"
            fi
          elif [ "$OUTCOME" = "skipped" ]; then
            if [ "$CHECK_OUTCOME" = "failure" ]; then
              echo "::warning::Publish skipped: this version is already published on npm. Bump the version in package.json to publish."
            else
              echo "::warning::Publish step was skipped (e.g. an earlier step failed)."
            fi
          else
            echo "::warning::NPM publish failed. For @selfxyz/qrcode we use Trusted Publishers (OIDC); check workflow and npm package settings."
          fi

  publish-common:
    needs: detect-changes
    if: needs.detect-changes.outputs.common_changed == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          registry-url: "https://registry.npmjs.org"
      - name: Install Dependencies
        uses: ./.github/actions/yarn-install

      - name: Build package
        run: |
          yarn workspace @selfxyz/common build

      - name: Check version not already published
        id: check_version
        working-directory: common
        run: |
          NAME=$(node -p "require('./package.json').name")
          VERSION=$(node -p "require('./package.json').version")
          if npm view "$NAME@$VERSION" version 2>/dev/null; then
            echo "::error::Version $VERSION of $NAME is already published on npm. Bump the version in package.json to publish."
            exit 1
          fi

      - name: "Pack with yarn (resolves workspace: protocol)"
        working-directory: common
        run: yarn pack --out package.tgz

      - name: Publish to npm
        working-directory: common
        id: publish
        run: |
          DRY_RUN="${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}"
          VERSION=$(node -p "require('./package.json').version")
          TAG=$([[ "$VERSION" == *-* ]] && echo "--tag beta" || echo "")
          npx npm@latest publish package.tgz --access public $TAG $DRY_RUN

      - name: Publish result
        if: always()
        run: |
          OUTCOME="${{ steps.publish.outcome }}"
          DRY_RUN="${{ github.event.inputs.dry_run }}"
          CHECK_OUTCOME="${{ steps.check_version.outcome }}"
          if [ "$OUTCOME" = "success" ]; then
            if [ "$DRY_RUN" = "true" ]; then
              echo "✅ Dry run completed (no package uploaded)"
            else
              echo "✅ Package published successfully"
            fi
          elif [ "$OUTCOME" = "skipped" ]; then
            if [ "$CHECK_OUTCOME" = "failure" ]; then
              echo "::warning::Publish skipped: this version is already published on npm. Bump the version in package.json to publish."
            else
              echo "::warning::Publish step was skipped (e.g. an earlier step failed)."
            fi
          else
            echo "::warning::NPM publish failed. For @selfxyz/common we use Trusted Publishers (OIDC); check workflow and npm package settings."
          fi
  publish-contracts:
    needs: detect-changes
    if: needs.detect-changes.outputs.contracts_changed == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          registry-url: "https://registry.npmjs.org"
      - name: Install Dependencies
        uses: ./.github/actions/yarn-install
      - name: Build package
        run: |
          yarn workspace @selfxyz/contracts build

      - name: Check version not already published
        id: check_version
        working-directory: contracts
        run: |
          NAME=$(node -p "require('./package.json').name")
          VERSION=$(node -p "require('./package.json').version")
          if npm view "$NAME@$VERSION" version 2>/dev/null; then
            echo "::error::Version $VERSION of $NAME is already published on npm. Bump the version in package.json to publish."
            exit 1
          fi

      - name: "Pack with yarn (resolves workspace: protocol)"
        working-directory: contracts
        run: yarn pack --out package.tgz

      - name: Publish to npm
        working-directory: contracts
        id: publish
        run: |
          DRY_RUN="${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}"
          VERSION=$(node -p "require('./package.json').version")
          TAG=$([[ "$VERSION" == *-* ]] && echo "--tag beta" || echo "")
          npx npm@latest publish package.tgz --access public $TAG $DRY_RUN

      - name: Publish result
        if: always()
        run: |
          OUTCOME="${{ steps.publish.outcome }}"
          DRY_RUN="${{ github.event.inputs.dry_run }}"
          CHECK_OUTCOME="${{ steps.check_version.outcome }}"
          if [ "$OUTCOME" = "success" ]; then
            if [ "$DRY_RUN" = "true" ]; then
              echo "✅ Dry run completed (no package uploaded)"
            else
              echo "✅ Package published successfully"
            fi
          elif [ "$OUTCOME" = "skipped" ]; then
            if [ "$CHECK_OUTCOME" = "failure" ]; then
              echo "::warning::Publish skipped: this version is already published on npm. Bump the version in package.json to publish."
            else
              echo "::warning::Publish step was skipped (e.g. an earlier step failed)."
            fi
          else
            echo "::warning::NPM publish failed. For @selfxyz/contracts we use Trusted Publishers (OIDC); check workflow and npm package settings."
          fi
  publish-qrcode-angular:
    needs: detect-changes
    if: needs.detect-changes.outputs.qrcode_angular_changed == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          registry-url: "https://registry.npmjs.org"

      - name: Install Dependencies
        uses: ./.github/actions/yarn-install

      - name: Build package
        run: |
          yarn workspace @selfxyz/qrcode-angular build:deps

      - name: Check version not already published
        id: check_version
        working-directory: sdk/qrcode-angular
        run: |
          NAME=$(node -p "require('./package.json').name")
          VERSION=$(node -p "require('./package.json').version")
          if npm view "$NAME@$VERSION" version 2>/dev/null; then
            echo "::error::Version $VERSION of $NAME is already published on npm. Bump the version in package.json to publish."
            exit 1
          fi

      - name: "Pack with yarn (resolves workspace: protocol)"
        working-directory: sdk/qrcode-angular
        run: yarn pack --out package.tgz

      - name: Publish to npm
        working-directory: sdk/qrcode-angular
        id: publish
        run: |
          DRY_RUN="${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}"
          VERSION=$(node -p "require('./package.json').version")
          TAG=$([[ "$VERSION" == *-* ]] && echo "--tag beta" || echo "")
          npx npm@latest publish package.tgz --access public $TAG $DRY_RUN

      - name: Publish result
        if: always()
        run: |
          OUTCOME="${{ steps.publish.outcome }}"
          DRY_RUN="${{ github.event.inputs.dry_run }}"
          CHECK_OUTCOME="${{ steps.check_version.outcome }}"
          if [ "$OUTCOME" = "success" ]; then
            if [ "$DRY_RUN" = "true" ]; then
              echo "✅ Dry run completed (no package uploaded)"
            else
              echo "✅ Package published successfully"
            fi
          elif [ "$OUTCOME" = "skipped" ]; then
            if [ "$CHECK_OUTCOME" = "failure" ]; then
              echo "::warning::Publish skipped: this version is already published on npm. Bump the version in package.json to publish."
            else
              echo "::warning::Publish step was skipped (e.g. an earlier step failed)."
            fi
          else
            echo "::warning::NPM publish failed. For @selfxyz/qrcode-angular we use Trusted Publishers (OIDC); check workflow and npm package settings."
          fi

  publish-msdk:
    needs: detect-changes
    if: needs.detect-changes.outputs.msdk_changed == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          registry-url: "https://registry.npmjs.org"

      - name: Install Dependencies
        uses: ./.github/actions/yarn-install

      - name: Build package dependencies
        run: |
          yarn workspace @selfxyz/common build
          yarn workspace @selfxyz/mobile-sdk-alpha build

      - name: "Pack with yarn (resolves workspace: protocol)"
        working-directory: packages/mobile-sdk-alpha
        run: yarn pack --out package.tgz

      - name: Publish to npm
        working-directory: packages/mobile-sdk-alpha
        id: publish
        run: |
          DRY_RUN="${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}"
          npx npm@latest publish package.tgz --access restricted --tag alpha $DRY_RUN

      - name: Publish result
        if: always()
        run: |
          OUTCOME="${{ steps.publish.outcome }}"
          DRY_RUN="${{ github.event.inputs.dry_run }}"
          if [ "$OUTCOME" = "success" ]; then
            if [ "$DRY_RUN" = "true" ]; then
              echo "✅ Dry run completed (no package uploaded)"
            else
              echo "✅ Package published successfully"
            fi
          elif [ "$OUTCOME" = "skipped" ]; then
            echo "::warning::Publish step was skipped (e.g. an earlier step failed)."
          else
            echo "::warning::NPM publish failed. For @selfxyz/mobile-sdk-alpha we use Trusted Publishers (OIDC); check workflow and npm package settings."
          fi