self/.github/workflows/npm-publish.yml

name: NPM Publish

on:
  push:
    branches:
      - dev
    paths:
      - "sdk/core/package.json"
      - "sdk/qrcode/package.json"
      - "common/package.json"
      - "packages/mobile-sdk-alpha/package.json"
      - "sdk/qrcode-angular/package.json"
      - "contracts/package.json"
  workflow_dispatch:
    inputs:
      dry_run:
        description: "Run publish with --dry-run"
        required: false
        type: boolean
        default: false

permissions:
  id-token: write # Required for OIDC
  contents: read

jobs:
  detect-changes:
    runs-on: ubuntu-slim
    outputs:
      core_changed: ${{ steps.check-version.outputs.core_changed }}
      qrcode_changed: ${{ steps.check-version.outputs.qrcode_changed }}
      common_changed: ${{ steps.check-version.outputs.common_changed }}
      contracts_changed: ${{ steps.check-version.outputs.contracts_changed }}
      qrcode_angular_changed: ${{ steps.check-version.outputs.qrcode_angular_changed }}
      msdk_changed: ${{ steps.check-version.outputs.msdk_changed }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 2

      - name: Check for version changes
        id: check-version
        run: |
          git diff HEAD^ HEAD --name-only | grep -q "sdk/core/package.json" && echo "core_changed=true" >> $GITHUB_OUTPUT || echo "core_changed=false" >> $GITHUB_OUTPUT
          git diff HEAD^ HEAD --name-only | grep -q "sdk/qrcode/package.json" && echo "qrcode_changed=true" >> $GITHUB_OUTPUT || echo "qrcode_changed=false" >> $GITHUB_OUTPUT
          git diff HEAD^ HEAD --name-only | grep -q "common/package.json" && echo "common_changed=true" >> $GITHUB_OUTPUT || echo "common_changed=false" >> $GITHUB_OUTPUT
          git diff HEAD^ HEAD --name-only | grep -q "contracts/package.json" && echo "contracts_changed=true" >> $GITHUB_OUTPUT || echo "contracts_changed=false" >> $GITHUB_OUTPUT
          git diff HEAD^ HEAD --name-only | grep -q "sdk/qrcode-angular/package.json" && echo "qrcode_angular_changed=true" >> $GITHUB_OUTPUT || echo "qrcode_angular_changed=false" >> $GITHUB_OUTPUT
          git diff HEAD^ HEAD --name-only | grep -q "packages/mobile-sdk-alpha/package.json" && echo "msdk_changed=true" >> $GITHUB_OUTPUT || echo "msdk_changed=false" >> $GITHUB_OUTPUT

          # check if it was dispatched manually as well
          if git diff HEAD^ HEAD -- sdk/core/package.json | grep -q '"version":' || [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "core_changed=true" >> $GITHUB_OUTPUT
          fi

          if git diff HEAD^ HEAD -- sdk/qrcode/package.json | grep -q '"version":' || [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "qrcode_changed=true" >> $GITHUB_OUTPUT
          fi

          if git diff HEAD^ HEAD -- common/package.json | grep -q '"version":' || [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "common_changed=true" >> $GITHUB_OUTPUT
          fi

          if git diff HEAD^ HEAD -- contracts/package.json | grep -q '"version":' || [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "contracts_changed=true" >> $GITHUB_OUTPUT
          fi

          if git diff HEAD^ HEAD -- sdk/qrcode-angular/package.json | grep -q '"version":' || [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "qrcode_angular_changed=true" >> $GITHUB_OUTPUT
          fi

          if git diff HEAD^ HEAD -- packages/mobile-sdk-alpha/package.json | grep -q '"version":' || [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "msdk_changed=true" >> $GITHUB_OUTPUT
          fi

  publish-core:
    needs: detect-changes
    if: needs.detect-changes.outputs.core_changed == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          registry-url: "https://registry.npmjs.org"

      - name: Install Dependencies
        uses: ./.github/actions/yarn-install

      - name: Build package
        run: |
          yarn workspace @selfxyz/core build:deps

      - name: Check version not already published
        id: check_version
        working-directory: sdk/core
        run: |
          NAME=$(node -p "require('./package.json').name")
          VERSION=$(node -p "require('./package.json').version")
          if npm view "$NAME@$VERSION" version 2>/dev/null; then
            echo "::error::Version $VERSION of $NAME is already published on npm. Bump the version in package.json to publish."
            exit 1
          fi

      - name: "Pack with yarn (resolves workspace: protocol)"
        working-directory: sdk/core
        run: yarn pack --out package.tgz

      - name: Publish to npm
        working-directory: sdk/core
        id: publish
        run: |
          DRY_RUN="${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}"
          VERSION=$(node -p "require('./package.json').version")
          TAG=$([[ "$VERSION" == *-* ]] && echo "--tag beta" || echo "")
          npx npm@latest publish package.tgz --access public $TAG $DRY_RUN

      - name: Publish result
        if: always()
        run: |
          OUTCOME="${{ steps.publish.outcome }}"
          DRY_RUN="${{ github.event.inputs.dry_run }}"
          CHECK_OUTCOME="${{ steps.check_version.outcome }}"
          if [ "$OUTCOME" = "success" ]; then
            if [ "$DRY_RUN" = "true" ]; then
              echo "✅ Dry run completed (no package uploaded)"
            else
              echo "✅ Package published successfully"
            fi
          elif [ "$OUTCOME" = "skipped" ]; then
            if [ "$CHECK_OUTCOME" = "failure" ]; then
              echo "::warning::Publish skipped: this version is already published on npm. Bump the version in package.json to publish."
            else
              echo "::warning::Publish step was skipped (e.g. an earlier step failed)."
            fi
          else
            echo "::warning::NPM publish failed. For @selfxyz/core we use Trusted Publishers (OIDC); check workflow and npm package settings."
          fi

  publish-qrcode:
    needs: detect-changes
    if: needs.detect-changes.outputs.qrcode_changed == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          registry-url: "https://registry.npmjs.org"

      - name: Install Dependencies
        uses: ./.github/actions/yarn-install

      - name: Build package
        run: |
          yarn workspace @selfxyz/qrcode build:deps

      - name: Check version not already published
        id: check_version
        working-directory: sdk/qrcode
        run: |
          NAME=$(node -p "require('./package.json').name")
          VERSION=$(node -p "require('./package.json').version")
          if npm view "$NAME@$VERSION" version 2>/dev/null; then
            echo "::error::Version $VERSION of $NAME is already published on npm. Bump the version in package.json to publish."
            exit 1
          fi

      - name: "Pack with yarn (resolves workspace: protocol)"
        working-directory: sdk/qrcode
        run: yarn pack --out package.tgz

      - name: Publish to npm
        working-directory: sdk/qrcode
        id: publish
        run: |
          DRY_RUN="${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}"
          VERSION=$(node -p "require('./package.json').version")
          TAG=$([[ "$VERSION" == *-* ]] && echo "--tag beta" || echo "")
          npx npm@latest publish package.tgz --access public $TAG $DRY_RUN

      - name: Publish result
        if: always()
        run: |
          OUTCOME="${{ steps.publish.outcome }}"
          DRY_RUN="${{ github.event.inputs.dry_run }}"
          CHECK_OUTCOME="${{ steps.check_version.outcome }}"
          if [ "$OUTCOME" = "success" ]; then
            if [ "$DRY_RUN" = "true" ]; then
              echo "✅ Dry run completed (no package uploaded)"
            else
              echo "✅ Package published successfully"
            fi
          elif [ "$OUTCOME" = "skipped" ]; then
            if [ "$CHECK_OUTCOME" = "failure" ]; then
              echo "::warning::Publish skipped: this version is already published on npm. Bump the version in package.json to publish."
            else
              echo "::warning::Publish step was skipped (e.g. an earlier step failed)."
            fi
          else
            echo "::warning::NPM publish failed. For @selfxyz/qrcode we use Trusted Publishers (OIDC); check workflow and npm package settings."
          fi

  publish-common:
    needs: detect-changes
    if: needs.detect-changes.outputs.common_changed == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          registry-url: "https://registry.npmjs.org"
      - name: Install Dependencies
        uses: ./.github/actions/yarn-install

      - name: Build package
        run: |
          yarn workspace @selfxyz/common build

      - name: Check version not already published
        id: check_version
        working-directory: common
        run: |
          NAME=$(node -p "require('./package.json').name")
          VERSION=$(node -p "require('./package.json').version")
          if npm view "$NAME@$VERSION" version 2>/dev/null; then
            echo "::error::Version $VERSION of $NAME is already published on npm. Bump the version in package.json to publish."
            exit 1
          fi

      - name: "Pack with yarn (resolves workspace: protocol)"
        working-directory: common
        run: yarn pack --out package.tgz

      - name: Publish to npm
        working-directory: common
        id: publish
        run: |
          DRY_RUN="${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}"
          VERSION=$(node -p "require('./package.json').version")
          TAG=$([[ "$VERSION" == *-* ]] && echo "--tag beta" || echo "")
          npx npm@latest publish package.tgz --access public $TAG $DRY_RUN

      - name: Publish result
        if: always()
        run: |
          OUTCOME="${{ steps.publish.outcome }}"
          DRY_RUN="${{ github.event.inputs.dry_run }}"
          CHECK_OUTCOME="${{ steps.check_version.outcome }}"
          if [ "$OUTCOME" = "success" ]; then
            if [ "$DRY_RUN" = "true" ]; then
              echo "✅ Dry run completed (no package uploaded)"
            else
              echo "✅ Package published successfully"
            fi
          elif [ "$OUTCOME" = "skipped" ]; then
            if [ "$CHECK_OUTCOME" = "failure" ]; then
              echo "::warning::Publish skipped: this version is already published on npm. Bump the version in package.json to publish."
            else
              echo "::warning::Publish step was skipped (e.g. an earlier step failed)."
            fi
          else
            echo "::warning::NPM publish failed. For @selfxyz/common we use Trusted Publishers (OIDC); check workflow and npm package settings."
          fi
  publish-contracts:
    needs: detect-changes
    if: needs.detect-changes.outputs.contracts_changed == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          registry-url: "https://registry.npmjs.org"
      - name: Install Dependencies
        uses: ./.github/actions/yarn-install
      - name: Build package
        run: |
          yarn workspace @selfxyz/contracts build

      - name: Check version not already published
        id: check_version
        working-directory: contracts
        run: |
          NAME=$(node -p "require('./package.json').name")
          VERSION=$(node -p "require('./package.json').version")
          if npm view "$NAME@$VERSION" version 2>/dev/null; then
            echo "::error::Version $VERSION of $NAME is already published on npm. Bump the version in package.json to publish."
            exit 1
          fi

      - name: "Pack with yarn (resolves workspace: protocol)"
        working-directory: contracts
        run: yarn pack --out package.tgz

      - name: Publish to npm
        working-directory: contracts
        id: publish
        run: |
          DRY_RUN="${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}"
          VERSION=$(node -p "require('./package.json').version")
          TAG=$([[ "$VERSION" == *-* ]] && echo "--tag beta" || echo "")
          npx npm@latest publish package.tgz --access public $TAG $DRY_RUN

      - name: Publish result
        if: always()
        run: |
          OUTCOME="${{ steps.publish.outcome }}"
          DRY_RUN="${{ github.event.inputs.dry_run }}"
          CHECK_OUTCOME="${{ steps.check_version.outcome }}"
          if [ "$OUTCOME" = "success" ]; then
            if [ "$DRY_RUN" = "true" ]; then
              echo "✅ Dry run completed (no package uploaded)"
            else
              echo "✅ Package published successfully"
            fi
          elif [ "$OUTCOME" = "skipped" ]; then
            if [ "$CHECK_OUTCOME" = "failure" ]; then
              echo "::warning::Publish skipped: this version is already published on npm. Bump the version in package.json to publish."
            else
              echo "::warning::Publish step was skipped (e.g. an earlier step failed)."
            fi
          else
            echo "::warning::NPM publish failed. For @selfxyz/contracts we use Trusted Publishers (OIDC); check workflow and npm package settings."
          fi
  publish-qrcode-angular:
    needs: detect-changes
    if: needs.detect-changes.outputs.qrcode_angular_changed == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          registry-url: "https://registry.npmjs.org"

      - name: Install Dependencies
        uses: ./.github/actions/yarn-install

      - name: Build package
        run: |
          yarn workspace @selfxyz/qrcode-angular build:deps

      - name: Check version not already published
        id: check_version
        working-directory: sdk/qrcode-angular
        run: |
          NAME=$(node -p "require('./package.json').name")
          VERSION=$(node -p "require('./package.json').version")
          if npm view "$NAME@$VERSION" version 2>/dev/null; then
            echo "::error::Version $VERSION of $NAME is already published on npm. Bump the version in package.json to publish."
            exit 1
          fi

      - name: "Pack with yarn (resolves workspace: protocol)"
        working-directory: sdk/qrcode-angular
        run: yarn pack --out package.tgz

      - name: Publish to npm
        working-directory: sdk/qrcode-angular
        id: publish
        run: |
          DRY_RUN="${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}"
          VERSION=$(node -p "require('./package.json').version")
          TAG=$([[ "$VERSION" == *-* ]] && echo "--tag beta" || echo "")
          npx npm@latest publish package.tgz --access public $TAG $DRY_RUN

      - name: Publish result
        if: always()
        run: |
          OUTCOME="${{ steps.publish.outcome }}"
          DRY_RUN="${{ github.event.inputs.dry_run }}"
          CHECK_OUTCOME="${{ steps.check_version.outcome }}"
          if [ "$OUTCOME" = "success" ]; then
            if [ "$DRY_RUN" = "true" ]; then
              echo "✅ Dry run completed (no package uploaded)"
            else
              echo "✅ Package published successfully"
            fi
          elif [ "$OUTCOME" = "skipped" ]; then
            if [ "$CHECK_OUTCOME" = "failure" ]; then
              echo "::warning::Publish skipped: this version is already published on npm. Bump the version in package.json to publish."
            else
              echo "::warning::Publish step was skipped (e.g. an earlier step failed)."
            fi
          else
            echo "::warning::NPM publish failed. For @selfxyz/qrcode-angular we use Trusted Publishers (OIDC); check workflow and npm package settings."
          fi

  publish-msdk:
    needs: detect-changes
    if: needs.detect-changes.outputs.msdk_changed == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          registry-url: "https://registry.npmjs.org"

      - name: Install Dependencies
        uses: ./.github/actions/yarn-install

      - name: Build package dependencies
        run: |
          yarn workspace @selfxyz/common build
          yarn workspace @selfxyz/mobile-sdk-alpha build

      - name: "Pack with yarn (resolves workspace: protocol)"
        working-directory: packages/mobile-sdk-alpha
        run: yarn pack --out package.tgz

      - name: Publish to npm
        working-directory: packages/mobile-sdk-alpha
        id: publish
        run: |
          DRY_RUN="${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}"
          npx npm@latest publish package.tgz --access restricted --tag alpha $DRY_RUN

      - name: Publish result
        if: always()
        run: |
          OUTCOME="${{ steps.publish.outcome }}"
          DRY_RUN="${{ github.event.inputs.dry_run }}"
          if [ "$OUTCOME" = "success" ]; then
            if [ "$DRY_RUN" = "true" ]; then
              echo "✅ Dry run completed (no package uploaded)"
            else
              echo "✅ Package published successfully"
            fi
          elif [ "$OUTCOME" = "skipped" ]; then
            echo "::warning::Publish step was skipped (e.g. an earlier step failed)."
          else
            echo "::warning::NPM publish failed. For @selfxyz/mobile-sdk-alpha we use Trusted Publishers (OIDC); check workflow and npm package settings."
          fi