name: split-release

on:
  pull_request:
  push:
    branches: [main]

permissions: {}

jobs:
  verify-pull-request:
    if: github.event_name == 'pull_request'
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - run: npm ci --ignore-scripts
      - run: npm test

  build-reviewed-main:
    if: github.event_name == 'push'
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - run: ./build-without-publication-credentials.sh
      - run: ./record-artifact-digest-and-provenance.sh

  publish-validated-artifact:
    needs: build-reviewed-main
    environment: package-publication
    permissions:
      id-token: write
    runs-on: ubuntu-latest
    steps:
      - run: ./verify-trusted-digest-and-provenance.sh
      - run: ./publish-only-quote-tool.sh