release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write
  id-token: write

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

# Pipeline shape (each stage gates the next via `needs:`):
#
#   test, test-pi, test-cli           (unit tests, parallel)
#                  ↓
#   e2e-opencode, e2e-pi              (Docker e2e, parallel — gated by unit tests)
#                  ↓
#   publish-npm, publish-npm-pi,
#   publish-npm-cli                   (npm publishes, parallel — gated by e2e)
#                  ↓
#   github-release                    (GH release tag — gated by all publishes)
#
# Prior to v0.21.x the Docker e2e ran in a separate workflow
# (e2e-docker.yml) on the same tag push, so publishes could complete
# even if Docker e2e failed. Folding it inline closes that gap.

jobs:
  test:
    name: Test (plugin)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install

      - name: TypeScript typecheck
        run: bun run typecheck

      - name: Lint
        run: bun run lint

      - name: Build
        run: bun run build

      - name: Test
        run: bun run test

  test-pi:
    name: Test (pi-plugin)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install

      - name: TypeScript typecheck
        run: bun run --cwd packages/pi-plugin typecheck

      - name: Lint
        run: bun run --cwd packages/pi-plugin lint

      - name: Build
        run: bun run --cwd packages/pi-plugin build

      - name: Test
        run: bun run --cwd packages/pi-plugin test

  test-cli:
    name: Test (cli)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install

      - name: TypeScript typecheck
        run: bun run --cwd packages/cli typecheck

      - name: Lint
        run: bun run --cwd packages/cli lint

      - name: Build
        run: bun run --cwd packages/cli build

      - name: Test
        run: bun run --cwd packages/cli test

  e2e-opencode:
    name: E2E (OpenCode, Docker)
    runs-on: ubuntu-latest
    needs: [test, test-cli]
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v5
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install workspace deps
        run: bun install --frozen-lockfile

      - name: Build OpenCode plugin
        run: bun run --cwd packages/plugin build

      - name: Build CLI
        # The CLI is its own package (@cortexkit/magic-context) since
        # v0.16.1; Dockerfile.opencode COPYs packages/cli/dist/ in.
        run: bun run --cwd packages/cli build

      - name: Build E2E image
        run: |
          docker build \
            --platform linux/amd64 \
            -f tests/docker/Dockerfile.opencode \
            -t mc-e2e-opencode \
            .

      - name: Run E2E
        run: docker run --rm --platform linux/amd64 mc-e2e-opencode

  e2e-pi:
    name: E2E (Pi, Docker)
    runs-on: ubuntu-latest
    needs: [test-pi, test-cli]
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v5
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install workspace deps
        run: bun install --frozen-lockfile

      - name: Build Pi plugin
        run: bun run --cwd packages/pi-plugin build

      - name: Build CLI
        # The CLI moved to its own package (@cortexkit/magic-context) in
        # v0.16.1. Dockerfile.pi COPYs packages/cli/dist/ in for the
        # `magic-context doctor --harness pi` test invocation.
        run: bun run --cwd packages/cli build

      - name: Build E2E image
        # The Pi Dockerfile installs runtime deps fresh inside the image
        # (better-sqlite3 builds against linux/amd64), so no host-side
        # `npm install` is needed.
        run: |
          docker build \
            --platform linux/amd64 \
            -f tests/docker/Dockerfile.pi \
            -t mc-e2e-pi \
            .

      - name: Run E2E
        run: docker run --rm --platform linux/amd64 mc-e2e-pi

  publish-npm:
    name: Publish plugin to npm
    runs-on: ubuntu-latest
    # Publishes are gated on the full e2e suite (OpenCode + Pi) so a tag
    # push can never produce a published npm package whose runtime fails
    # the install + first-turn smoke test.
    needs: [test, test-pi, test-cli, e2e-opencode, e2e-pi]
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-node@v5
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      - name: Ensure latest npm (for trusted publishing)
        run: npm install -g npm@latest

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install

      - name: Sync version from tag
        run: node scripts/version-sync.mjs --from-tag

      - name: Build plugin
        run: bun run --cwd packages/plugin build

      - name: Generate schema
        run: bun packages/plugin/scripts/build-schema.ts

      - name: Copy README for npm package
        run: cp README.md packages/plugin/README.md

      # Uses npm Trusted Publishing (OIDC) — configured on npmjs.com
      - name: Publish to npm
        run: npm publish --access public --provenance
        working-directory: packages/plugin

  publish-npm-pi:
    name: Publish pi-plugin to npm
    runs-on: ubuntu-latest
    needs: [test, test-pi, test-cli, e2e-opencode, e2e-pi]
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-node@v5
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      - name: Ensure latest npm (for trusted publishing)
        run: npm install -g npm@latest

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install

      - name: Sync version from tag
        run: node scripts/version-sync.mjs --from-tag

      - name: Build pi-plugin
        run: bun run --cwd packages/pi-plugin build

      # Uses npm Trusted Publishing (OIDC) — must be configured on npmjs.com
      # for @cortexkit/pi-magic-context before first release.
      - name: Publish to npm
        run: npm publish --access public --provenance
        working-directory: packages/pi-plugin

  publish-npm-cli:
    name: Publish unified CLI to npm
    runs-on: ubuntu-latest
    needs: [test, test-pi, test-cli, e2e-opencode, e2e-pi]
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-node@v5
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      - name: Ensure latest npm (for trusted publishing)
        run: npm install -g npm@latest

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install

      - name: Sync version from tag
        run: node scripts/version-sync.mjs --from-tag

      - name: Build cli
        run: bun run --cwd packages/cli build

      # Uses npm Trusted Publishing (OIDC) — must be configured on npmjs.com
      # for @cortexkit/magic-context before first release.
      - name: Publish to npm
        run: npm publish --access public --provenance
        working-directory: packages/cli

  github-release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    # Wait for ALL three npm publishes to succeed before tagging the
    # GitHub release. Previously this depended only on test jobs, so a
    # publish timeout or registry failure could leave a published release
    # page on GitHub while one of the @cortexkit/* packages was missing
    # from npm.
    needs: [test, test-pi, test-cli, e2e-opencode, e2e-pi, publish-npm, publish-npm-pi, publish-npm-cli]
    steps:
      - uses: actions/checkout@v5

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true