name: Publish

# Runs after the Release workflow completes successfully
on:
  workflow_run:
    workflows: [Release]
    types: [completed]

jobs:
  publish-crates:
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - run: cargo publish --token ${{ secrets.CARGO_REGISTRY_TOKEN }}

  publish-npm:
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    defaults:
      run:
        working-directory: npm
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"
      - name: Update npm
        run: npm install -g npm@latest
      # Sync npm package version with Cargo.toml version
      - name: Sync version
        run: |
          VERSION=$(grep '^version' ../Cargo.toml | head -1 | sed 's/.*"\(.*\)"/\1/')
          node -e "
            const pkg = require('./package.json');
            pkg.version = '$VERSION';
            pkg.binaryVersion = '$VERSION';
            require('fs').writeFileSync('./package.json', JSON.stringify(pkg, null, 2) + '\n');
          "
      # No NODE_AUTH_TOKEN — uses OIDC trusted publishing
      - run: npm publish --access public
