release-auth-check.yml

name: Release Authentication Check

on:
  workflow_dispatch:

permissions:
  contents: read
  id-token: write

jobs:
  npm-auth:
    runs-on: ubuntu-latest
    steps:
      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 22
          registry-url: https://registry.npmjs.org

      - name: Verify OIDC publishing readiness
        run: |
          npm install --global npm@11.20.0
          node -e "const [major, minor] = process.versions.node.split('.').map(Number); if (major < 22 || (major === 22 && minor < 14)) process.exit(1)"
          if [ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ] || [ -z "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" ]; then
            echo "::error::GitHub OIDC token request is unavailable to this workflow."
            exit 2
          fi
          npm --version
          npm view monsqlize dist-tags.latest --registry=https://registry.npmjs.org/
          echo "Runner OIDC is ready. Confirm monsqlize trusts devcodex-labs/monSQLize publish.yml with npm publish allowed in npm package settings before tagging."