validate.yml

# pnpm install needs GH_PACKAGES_TOKEN_READ: GITHUB_TOKEN cannot read @behindthemusictree/* when published from another repo (403 read_package).
name: Validate

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]

env:
  NPM_TOKEN: ${{ secrets.GH_PACKAGES_TOKEN_READ }}

jobs:
  ensure-packages-token:
    name: GitHub Packages token
    runs-on: ubuntu-latest
    steps:
      - name: Require GH_PACKAGES_TOKEN_READ secret
        run: |
          if [ -z "$NPM_TOKEN" ]; then
            echo "::error::Repository secret GH_PACKAGES_TOKEN_READ is required (or this repo needs to be added to the org-level secret's selected repos). Add/enable a GitHub PAT with read:packages so pnpm install can install @behindthemusictree/*. GITHUB_TOKEN cannot read packages published from other repositories (403 permission_denied: read_package)."
            exit 1
          fi

  build:
    runs-on: ubuntu-latest
    needs: [ensure-packages-token]
    steps:
      - uses: actions/checkout@v5

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v5
        with:
          node-version: 22

      - run: pnpm install --frozen-lockfile
      - run: pnpm build
      - run: pnpm lint
      - run: pnpm test