npm_napi_release.yml

name: NPM Node-API Release
on:
  push:
    branches:
      - main
    tags:
      - "v*"

env:
  XCODE_VERSION: "26.2.0"

jobs:
  build:
    name: Build
    runs-on: macos-26
    outputs:
      npm_version_ios: ${{ steps.npm_version_output.outputs.NPM_VERSION_IOS }}
      npm_tag_ios: ${{ steps.npm_version_output.outputs.NPM_TAG_IOS }}
      npm_version_macos: ${{ steps.npm_version_output.outputs.NPM_VERSION_MACOS }}
      npm_tag_macos: ${{ steps.npm_version_output.outputs.NPM_TAG_MACOS }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit
      - uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
        with:
          xcode-version: ${{env.XCODE_VERSION}}
      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 0
      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
        with:
          node-version: 24
          registry-url: "https://registry.npmjs.org"
      - name: Install Python
        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
        with:
          python-version: "3"
      - name: Install Dependencies
        run: |
          npm install
          python3 -m pip install --upgrade pip six
          # Ensure LLVM linker used by -fuse-ld=lld is available
          if ! command -v ld64.lld >/dev/null; then
            brew list lld || brew install lld
          fi
          # Ensure CMake is available without conflicting with pinned Homebrew formula
          if ! command -v cmake >/dev/null; then
            brew list cmake || brew install cmake
          fi
          # Some scripts expect cmake at /usr/local/bin; create a shim if needed
          if [ ! -x /usr/local/bin/cmake ]; then
            sudo mkdir -p /usr/local/bin
            sudo ln -sf "$(command -v cmake)" /usr/local/bin/cmake
          fi
      - name: Bump versions for dev release
        if: ${{ !contains(github.ref, 'refs/tags/') }}
        run: |
          # Bump @nativescript/ios-node-api
          NPM_VERSION_IOS=$(node ./scripts/get-next-version.js ios)
          echo NPM_VERSION_IOS=$NPM_VERSION_IOS >> $GITHUB_ENV
          cd packages/ios
          npm version $NPM_VERSION_IOS --no-git-tag-version
          cd -

          # Bump @nativescript/macos-node-api
          NPM_VERSION_MACOS=$(node ./scripts/get-next-version.js macos)
          echo NPM_VERSION_MACOS=$NPM_VERSION_MACOS >> $GITHUB_ENV
          cd packages/macos
          npm version $NPM_VERSION_MACOS --no-git-tag-version
          cd -
      - name: Output NPM Versions and tags
        id: npm_version_output
        run: |
          NPM_TAG_IOS=$(node ./scripts/get-npm-tag.js ios)
          NPM_TAG_MACOS=$(node ./scripts/get-npm-tag.js macos)
          echo NPM_VERSION_IOS=$NPM_VERSION_IOS >> $GITHUB_OUTPUT
          echo NPM_VERSION_MACOS=$NPM_VERSION_MACOS >> $GITHUB_OUTPUT
          echo NPM_TAG_IOS=$NPM_TAG_IOS >> $GITHUB_OUTPUT
          echo NPM_TAG_MACOS=$NPM_TAG_MACOS >> $GITHUB_OUTPUT
      - name: Build
        run: ./build_all_react_native.sh
      - name: Pack @nativescript/ios-node-api
        working-directory: packages/ios
        run: npm pack
      - name: Pack @nativescript/macos-node-api
        working-directory: packages/macos
        run: npm pack
      - name: Upload npm package artifact for @nativescript/ios-node-api
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: nativescript-ios-node-api
          path: packages/ios/nativescript-ios-node-api-${{steps.npm_version_output.outputs.NPM_VERSION_IOS}}.tgz
      - name: Upload npm package artifact for @nativescript/macos-node-api
        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
        with:
          name: nativescript-macos-node-api
          path: packages/macos/nativescript-macos-node-api-${{steps.npm_version_output.outputs.NPM_VERSION_MACOS}}.tgz
  publish:
    runs-on: ubuntu-latest
    environment: npm-publish
    needs:
      - build
    permissions:
      contents: read
      id-token: write
    env:
      NPM_VERSION_IOS: ${{needs.build.outputs.npm_version_ios}}
      NPM_TAG_IOS: ${{needs.build.outputs.npm_tag_ios}}
      NPM_VERSION_MACOS: ${{needs.build.outputs.npm_version_macos}}
      NPM_TAG_MACOS: ${{needs.build.outputs.npm_tag_macos}}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit
      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
        with:
          node-version: 24
          registry-url: "https://registry.npmjs.org"
      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          name: nativescript-ios-node-api
          path: packages/ios
      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          name: nativescript-macos-node-api
          path: packages/macos
      - name: Update npm (required for OIDC trusted publishing)
        run: |
          npm install -g npm@^11.6.2
          npm --version
      - name: Publish @nativescript/ios-node-api package (OIDC trusted publishing)
        if: ${{ vars.USE_NPM_TOKEN != 'true' }}
        run: |
          echo "Publishing @nativescript/ios-node-api@$NPM_VERSION_IOS to NPM with tag $NPM_TAG_IOS via OIDC trusted publishing..."
          unset NODE_AUTH_TOKEN
          if [ -n "${NPM_CONFIG_USERCONFIG:-}" ]; then
            rm -f "$NPM_CONFIG_USERCONFIG"
          fi
          npm publish packages/ios/nativescript-ios-node-api-${{env.NPM_VERSION_IOS}}.tgz --tag $NPM_TAG_IOS --access public --provenance
        env:
          NODE_AUTH_TOKEN: ""
      - name: Publish @nativescript/macos-node-api package (OIDC trusted publishing)
        if: ${{ vars.USE_NPM_TOKEN != 'true' }}
        run: |
          echo "Publishing @nativescript/macos-node-api@$NPM_VERSION_MACOS to NPM with tag $NPM_TAG_MACOS via OIDC trusted publishing..."
          unset NODE_AUTH_TOKEN
          if [ -n "${NPM_CONFIG_USERCONFIG:-}" ]; then
            rm -f "$NPM_CONFIG_USERCONFIG"
          fi
          npm publish packages/macos/nativescript-macos-node-api-${{env.NPM_VERSION_MACOS}}.tgz --tag $NPM_TAG_MACOS --access public --provenance
        env:
          NODE_AUTH_TOKEN: ""
      - name: Publish @nativescript/ios-node-api package (granular token)
        if: ${{ vars.USE_NPM_TOKEN == 'true' }}
        run: |
          echo "Publishing @nativescript/ios-node-api@$NPM_VERSION to NPM with tag $NPM_TAG_IOS via granular token..."
          npm publish packages/ios/nativescript-ios-node-api-${{env.NPM_VERSION_IOS}}.tgz --tag $NPM_TAG_IOS --access public --provenance
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
      - name: Publish @nativescript/macos-node-api package (granular token)
        if: ${{ vars.USE_NPM_TOKEN == 'true' }}
        run: |
          echo "Publishing @nativescript/macos-node-api@$NPM_VERSION to NPM with tag $NPM_TAG_MACOS via granular token..."
          npm publish packages/macos/nativescript-macos-node-api-${{env.NPM_VERSION_MACOS}}.tgz --tag $NPM_TAG_MACOS --access public --provenance
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
  github-release:
    runs-on: ubuntu-latest
    # only runs on tagged commits
    if: ${{ contains(github.ref, 'refs/tags/') }}
    permissions:
      contents: write
    needs:
      - build
    env:
      NPM_VERSION_IOS: ${{needs.build.outputs.npm_version_ios}}
      NPM_VERSION_MACOS: ${{needs.build.outputs.npm_version_macos}}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
        with:
          egress-policy: audit
      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          fetch-depth: 0
      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
        with:
          node-version: 24
      - name: Setup
        run: npm install
      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          name: nativescript-ios-node-api
          path: packages/ios
      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          name: nativescript-macos-node-api
          path: packages/macos
      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          name: nativescript-macos-node-api
          path: packages/macos
      - name: Partial Changelog
        run: npx conventional-changelog -p angular -r2 > body.md
      - uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1.20.0
        with:
          artifacts: "packages/macos/nativescript-macos-node-api-*.tgz,packages/ios/nativescript-ios-node-api-*.tgz"
          bodyFile: "body.md"
          prerelease: ${{needs.build.outputs.npm_tag_ios != 'latest' && needs.build.outputs.npm_tag_macos != 'latest'}}
          allowUpdates: true