elizaos--eliza/.github/workflows/publish-plugin-elizacloud.yml

# Publishes @elizaos/plugin-elizacloud (npm) when the version in
# plugins/plugin-elizacloud/package.json changes.
name: Publish @elizaos/plugin-elizacloud

on:
  push:
    branches: [main, develop]
    paths:
      - "plugins/plugin-elizacloud/**"
      - ".github/workflows/publish-plugin-elizacloud.yml"
  workflow_dispatch:

concurrency:
  group: publish-plugin-elizacloud-${{ github.ref }}
  cancel-in-progress: false

# Default to least privilege. Override per-job where needed.
permissions:
  contents: read

jobs:
  verify_version:
    runs-on: ${{ fromJSON(vars.HETZNER_FLEET_ONLINE == 'false' && '["ubuntu-24.04"]' || '["self-hosted","hetzner-robot"]') }}
    outputs:
      should_publish: ${{ steps.check.outputs.should_publish }}
      version: ${{ steps.check.outputs.version }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          fetch-depth: 0
          filter: blob:none

      - name: Check package version
        id: check
        run: |
          set -euo pipefail
          PKG_JSON="plugins/plugin-elizacloud/package.json"
          CURRENT_VERSION=$(jq -r .version "$PKG_JSON")
          echo "Current version: $CURRENT_VERSION"
          PREV_COMMIT=$(git rev-parse HEAD~1 2>/dev/null || git rev-parse HEAD)
          if git diff --name-only HEAD~1 HEAD | grep -q "$PKG_JSON"; then
            if git show "$PREV_COMMIT:$PKG_JSON" 2>/dev/null; then
              PREV_VERSION=$(git show "$PREV_COMMIT:$PKG_JSON" | jq -r .version)
              echo "Previous version: $PREV_VERSION"
              if [ "$CURRENT_VERSION" != "$PREV_VERSION" ]; then
                echo "should_publish=true" >> "$GITHUB_OUTPUT"
              else
                echo "should_publish=false" >> "$GITHUB_OUTPUT"
              fi
            else
              echo "should_publish=true" >> "$GITHUB_OUTPUT"
            fi
          else
            echo "should_publish=false" >> "$GITHUB_OUTPUT"
          fi
          echo "version=$CURRENT_VERSION" >> "$GITHUB_OUTPUT"

  publish_npm:
    needs: verify_version
    if: needs.verify_version.outputs.should_publish == 'true'
    runs-on: ${{ fromJSON(vars.HETZNER_FLEET_ONLINE == 'false' && '["ubuntu-24.04"]' || '["self-hosted","hetzner-robot"]') }}
    permissions:
      contents: write
      id-token: write   # npm OIDC trusted publishing (SOC2 CC9.2)
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          fetch-depth: 0
          filter: blob:none

      - name: Create Git tag
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git tag -a "plugin-elizacloud-v${{ needs.verify_version.outputs.version }}" -m "plugin-elizacloud v${{ needs.verify_version.outputs.version }}" || true
          git push origin "plugin-elizacloud-v${{ needs.verify_version.outputs.version }}" || true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
        with:
          bun-version: canary

      - name: Install and build
        working-directory: plugins/plugin-elizacloud
        run: |
          bun install
          bun run build:ts

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      - name: Publish to npm
        # Auth: prefer npm OIDC (id-token: write); NPM_TOKEN is the transition
        # fallback. Configure Trusted Publisher on npmjs.com for this workflow:
        # https://docs.npmjs.com/trusted-publishers
        working-directory: plugins/plugin-elizacloud
        run: npm publish --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_CONFIG_PROVENANCE: "true"