release.yml

name: Release

on:
  push:
    tags:
      - 'v*'
    branches-ignore:
      - '**'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Existing tag to publish (for backfill), e.g. v0.4.2'
        required: true
        type: string

permissions:
  contents: write

jobs:
  publish-release:
    if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Resolve tag
        id: tag
        shell: bash
        run: |
          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
            TAG="${{ inputs.tag }}"
          else
            TAG="${GITHUB_REF_NAME}"
          fi

          if [[ -z "${TAG}" ]]; then
            echo "Tag could not be resolved." >&2
            exit 1
          fi

          echo "value=${TAG}" >> "$GITHUB_OUTPUT"

      - name: Verify tag
        shell: bash
        run: |
          TAG="${{ steps.tag.outputs.value }}"
          if [[ ! "${TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Invalid tag format: ${TAG}. Expected v<major>.<minor>.<patch>" >&2
            exit 1
          fi

          if [[ "${GITHUB_EVENT_NAME}" == "push" ]]; then
            PKG_VERSION="$(node -p "require('./packages/cli/package.json').version")"
            EXPECTED_TAG="v${PKG_VERSION}"

            if [[ "${TAG}" != "${EXPECTED_TAG}" ]]; then
              echo "Tag/version mismatch on push: got ${TAG}, expected ${EXPECTED_TAG}" >&2
              exit 1
            fi
          else
            if ! git rev-parse -q --verify "refs/tags/${TAG}" >/dev/null; then
              echo "Tag not found in repository: ${TAG}" >&2
              exit 1
            fi
          fi

      - name: Build release notes from CHANGELOG
        shell: bash
        run: |
          TAG="${{ steps.tag.outputs.value }}"
          VERSION="${TAG#v}"

          awk -v version="${VERSION}" '
            BEGIN { in_section=0 }
            $0 ~ "^## \\[" version "\\]" { in_section=1; print; next }
            in_section && $0 ~ "^## \\[" { exit }
            in_section { print }
          ' CHANGELOG.md > release_notes.md

          if [[ ! -s release_notes.md ]]; then
            echo "## ${TAG}" > release_notes.md
            echo >> release_notes.md
            echo "See CHANGELOG.md for release details." >> release_notes.md
          fi

      - name: Create or update GitHub Release
        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
        with:
          tag_name: ${{ steps.tag.outputs.value }}
          name: ${{ steps.tag.outputs.value }}
          body_path: release_notes.md
          generate_release_notes: true

  publish-npm:
    if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          ref: ${{ inputs.tag || github.ref }}

      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8

      # No registry-url: setup-node would otherwise write ~/.npmrc with a
      # _authToken line, which makes npm CLI prefer token auth over the
      # OIDC flow that trusted publishers require.
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: '20'
          cache: 'pnpm'

      # npm 11.5.1+ required for trusted-publisher OIDC auth on publish.
      # The version bundled with Node 20 on setup-node is ~10.x.
      - name: Upgrade npm for trusted-publisher support
        run: npm install -g npm@latest

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build
        run: pnpm run build

      # Enforces unified workspace versioning: every packages/*/package.json must match the tag.
      # If Charter adopts independent package versions, replace this with per-package release metadata.
      - name: Verify tag and workspace versions
        shell: bash
        run: |
          TAG="${{ github.event.inputs.tag || github.ref_name }}"
          if [[ ! "${TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "::error::Invalid tag format: ${TAG}. Expected v<major>.<minor>.<patch>"
            exit 1
          fi

          EXPECTED="${TAG#v}"
          FAIL=0
          for p in packages/*/package.json; do
            V=$(node -p "require('./$p').version")
            N=$(node -p "require('./$p').name")
            if [[ "$V" != "$EXPECTED" ]]; then
              echo "::error::$N version $V does not match tag $EXPECTED"
              FAIL=1
            fi
          done
          if [[ $FAIL -ne 0 ]]; then exit 1; fi

      - name: Verify packed manifests
        run: pnpm run publish:check

      # Auth is OIDC via npm trusted publishers — no NPM_TOKEN needed.
      # See: https://docs.npmjs.com/trusted-publishers
      - name: Publish to npm
        shell: bash
        run: |
          TAG="${{ github.event.inputs.tag || github.ref_name }}"
          VERSION="${TAG#v}"
          mkdir -p release-tarballs

          pack_package() {
            local package_dir="$1"
            (cd "${package_dir}" && pnpm pack --pack-destination ../../release-tarballs)
          }

          pack_package packages/types
          pack_package packages/core
          pack_package packages/adf
          pack_package packages/git
          pack_package packages/classify
          pack_package packages/validate
          pack_package packages/drift
          pack_package packages/blast
          pack_package packages/surface
          pack_package packages/policies
          pack_package packages/ci
          pack_package packages/cli

          # publish_if_missing: skip packages already published at this version (idempotent re-runs)
          publish_if_missing() {
            local tarball="$1"
            local pkg_name="$2"
            if npm view "${pkg_name}@${VERSION}" version &>/dev/null 2>&1; then
              echo "Skipping ${pkg_name}@${VERSION} — already published"
            else
              npm publish "${tarball}" --access public --provenance
            fi
          }

          publish_if_missing "./release-tarballs/stackbilt-types-${VERSION}.tgz"    "@stackbilt/types"
          publish_if_missing "./release-tarballs/stackbilt-core-${VERSION}.tgz"     "@stackbilt/core"
          publish_if_missing "./release-tarballs/stackbilt-adf-${VERSION}.tgz"      "@stackbilt/adf"
          publish_if_missing "./release-tarballs/stackbilt-git-${VERSION}.tgz"      "@stackbilt/git"
          publish_if_missing "./release-tarballs/stackbilt-classify-${VERSION}.tgz" "@stackbilt/classify"
          publish_if_missing "./release-tarballs/stackbilt-validate-${VERSION}.tgz" "@stackbilt/validate"
          publish_if_missing "./release-tarballs/stackbilt-drift-${VERSION}.tgz"    "@stackbilt/drift"
          publish_if_missing "./release-tarballs/stackbilt-blast-${VERSION}.tgz"    "@stackbilt/blast"
          publish_if_missing "./release-tarballs/stackbilt-surface-${VERSION}.tgz"  "@stackbilt/surface"
          publish_if_missing "./release-tarballs/stackbilt-policies-${VERSION}.tgz" "@stackbilt/policies"
          publish_if_missing "./release-tarballs/stackbilt-ci-${VERSION}.tgz"       "@stackbilt/ci"
          publish_if_missing "./release-tarballs/stackbilt-cli-${VERSION}.tgz"      "@stackbilt/cli"