push-github-registry.yml

# Pushes the root CLI package to GitHub Packages (npm-compatible registry at npm.pkg.github.com).
# Package scope (@OWNER) must match github.repository_owner. Consumers authenticate once via PAT — see README.
# Runs only on the canonical upstream repo (aligned with npm Trusted Publisher gate).
name: Push CLI to GitHub registry

on:
  push:
    branches: ["main"]
    paths:
      - "package.json"
      - "package-lock.json"
      - "src/**"
      - "templates/**"
      - "tsconfig.json"
  workflow_dispatch:

permissions:
  contents: read
  packages: write

jobs:
  push:
    runs-on: ubuntu-latest
    if: github.repository == 'deb-adarsh/ai-stack-kit'

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js for GitHub npm registry
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          registry-url: "https://npm.pkg.github.com"
          scope: "@${{ github.repository_owner }}"
          cache: npm
          cache-dependency-path: package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Push to GitHub registry if version is new
        run: |
          PKG="$(node -p "require('./package.json').name")"
          VER="$(node -p "require('./package.json').version")"
          REG="https://npm.pkg.github.com"
          set +e
          npm view "${PKG}@${VER}" version --registry="${REG}" >/dev/null 2>&1
          HAS_RC=$?
          set -e
          if [ "$HAS_RC" -eq 0 ]; then
            echo "Skip push — ${PKG}@${VER} already exists on GitHub registry."
            exit 0
          fi
          npm publish --registry="${REG}"
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}