release.yml

# Tag-driven releases. Cut from `stage` by pushing a version tag; the tag name IS the version.
#
#   v1.2.3-rc.1  -> RC pre-release   : npm dist-tag `rc`,     GitHub pre-release
#   v1.2.3       -> STABLE release   : npm dist-tag `latest`, GitHub Release
#
# Cutting a stable release (from stage):
#   1. `pnpm changeset version`  (consumes changesets, bumps `@openora/*`, writes CHANGELOGs)
#   2. commit + push stage (and fast-forward dev), then `git tag vX.Y.Z && git push origin vX.Y.Z`
# Cutting an rc: from stage, `git tag vX.Y.Z-rc.N && git push origin vX.Y.Z-rc.N` (no changeset
# consumption - a candidate of the upcoming X.Y.Z; the tag sets the published version).
#
# canary builds are separate and automatic on every dev push (pipeline.yml).
# Auth: NPM_TOKEN (npm automation / 2FA-bypass token); provenance signed via OIDC (id-token).
name: Release

on:
  push:
    tags: ['v[0-9]+.[0-9]+.[0-9]+', 'v[0-9]+.[0-9]+.[0-9]+-*']

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write # create the GitHub Release
      id-token: write # npm provenance (signed build attestation)
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 26
          registry-url: https://registry.npmjs.org
          scope: '@openora'

      - name: Enable corepack (pnpm)
        run: |
          npm install -g corepack@latest
          corepack enable
          corepack prepare pnpm@11.8.0 --activate

      - run: pnpm install --frozen-lockfile

      # The tag name is the source of truth. A prerelease tag (contains a '-') -> rc channel.
      - name: Resolve channel from tag
        id: rel
        run: |
          V="${GITHUB_REF_NAME#v}"
          echo "version=$V" >> "$GITHUB_OUTPUT"
          if [[ "$V" == *-* ]]; then
            echo "disttag=rc" >> "$GITHUB_OUTPUT"
            echo "prerelease=--prerelease" >> "$GITHUB_OUTPUT"
          else
            echo "disttag=latest" >> "$GITHUB_OUTPUT"
            echo "prerelease=" >> "$GITHUB_OUTPUT"
          fi

      - name: Build and publish
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_CONFIG_PROVENANCE: true
          V: ${{ steps.rel.outputs.version }}
          DISTTAG: ${{ steps.rel.outputs.disttag }}
        run: |
          # Pin the publishable packages to the tag's exact version (ephemeral - not committed).
          node -e "for (const p of ['packages/core/package.json','packages/mcp/package.json','packages/create-openora/package.json']) { const fs=require('fs'); const j=JSON.parse(fs.readFileSync(p,'utf8')); j.version=process.env.V; fs.writeFileSync(p, JSON.stringify(j,null,2)+'\n'); }"
          pnpm build
          if [ "$DISTTAG" = "latest" ]; then
            pnpm changeset publish --no-git-tag
          else
            pnpm changeset publish --no-git-tag --tag "$DISTTAG"
          fi

      - name: GitHub Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create "$GITHUB_REF_NAME" --title "$GITHUB_REF_NAME" --generate-notes ${{ steps.rel.outputs.prerelease }}