PublishModuleToPowerShellGallery.yaml

name: Publish Module to PowerShell Gallery

on:
  push:
    branches:
      - main
    paths:
      - '{{ModuleName}}/{{ModuleName}}.psd1'
  workflow_dispatch:

permissions:
  contents: write

jobs:
  publish:
    name: Publish Module
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      # Never publish the un-initialized template — the .psd1 still has
      # {{ModuleName}} and {{GUID}} placeholders. Same marker as CI.yaml:
      # CHANGELOG.template.md exists only pre-init. hashFiles() is not allowed
      # in jobs.<job_id>.if, so we evaluate it in a step and gate the
      # version-detection and release-check steps on the resulting output;
      # everything downstream cascades on those steps' outputs and skips
      # naturally when they don't run.
      - name: Detect template state
        id: template_guard
        shell: bash
        run: |
          if [ -f CHANGELOG.template.md ]; then
            echo "is_template=true" >> "$GITHUB_OUTPUT"
          else
            echo "is_template=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Get Module Version
        id: version
        if: steps.template_guard.outputs.is_template == 'false'
        shell: pwsh
        run: |
          $manifest = Import-PowerShellDataFile -Path ./{{ModuleName}}/{{ModuleName}}.psd1
          $version = $manifest.ModuleVersion
          Write-Host "Module version: $version"
          "version=$version" | Out-File -FilePath $env:GITHUB_OUTPUT -Append

      - name: Check if Release Exists
        id: check_release
        if: steps.template_guard.outputs.is_template == 'false'
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          if gh release view "v$VERSION" > /dev/null 2>&1; then
            echo "exists=true" >> $GITHUB_OUTPUT
            echo "GitHub release v$VERSION already exists"
          else
            echo "exists=false" >> $GITHUB_OUTPUT
            echo "GitHub release v$VERSION does not exist"
          fi

      - name: Check if PSGallery Version Exists
        id: check_psgallery
        # Run regardless of whether the GitHub release exists, so a release that was
        # created but never published can still be recovered (see Publish gating below).
        if: steps.template_guard.outputs.is_template == 'false'
        shell: pwsh
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          $version = $env:VERSION
          $findError = $null
          $published = Find-Module -Name {{ModuleName}} -RequiredVersion $version -Repository PSGallery -ErrorAction SilentlyContinue -ErrorVariable findError
          if ($published) {
            Write-Host "PSGallery version $version already exists"
            "exists=true" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
          } elseif ($findError) {
            # Find-Module records no error when the version simply isn't on the gallery,
            # so a recorded error means the query itself failed (transient/network). Don't
            # treat that as "not published" (publishing is now gated only on this check) —
            # fail so the run is visibly retryable instead of attempting a blind publish.
            throw "PowerShell Gallery query failed for version ${version}: $($findError[0].Exception.Message)"
          } else {
            Write-Host "PSGallery version $version not found - will publish"
            "exists=false" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
          }

      - name: Bootstrap
        if: steps.check_release.outputs.exists == 'false' || steps.check_psgallery.outputs.exists == 'false'
        shell: pwsh
        run: ./build.ps1 -Task Init -Bootstrap

      - name: Create GitHub Release
        if: steps.check_release.outputs.exists == 'false'
        shell: pwsh
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REPOSITORY: ${{ github.repository }}
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          $version = $env:VERSION

          # Build release notes from this version's CHANGELOG.md section so the release
          # body carries only the curated, user-facing entries (not the full PR list that
          # --generate-notes produces, which is dominated by bot/CI/chore PRs).
          # Read defensively: a missing/unreadable CHANGELOG.md must fall back to
          # --generate-notes (below), never fail the publish.
          $changelogLines = $null
          if (Test-Path -LiteralPath './CHANGELOG.md') {
              try {
                  $changelogLines = Get-Content -LiteralPath './CHANGELOG.md' -ErrorAction Stop
              }
              catch {
                  Write-Host "::warning::Could not read CHANGELOG.md ($($_.Exception.Message)); falling back to auto-generated notes."
              }
          }
          $captured = [System.Collections.Generic.List[string]]::new()
          if ($changelogLines) {
              $headerPattern = '^##\s+\[' + [regex]::Escape($version) + '\]'
              $capturing = $false
              foreach ($line in $changelogLines) {
                  if (-not $capturing) {
                      if ($line -match $headerPattern) { $capturing = $true }
                      continue
                  }
                  if ($line -match '^##\s+\[') { break }   # next version header ends the section
                  $captured.Add($line)
              }
          }
          $body = ($captured -join "`n").Trim()

          if ([string]::IsNullOrWhiteSpace($body)) {
              Write-Host "::warning::No CHANGELOG.md section found for $version; falling back to auto-generated notes."
              gh release create "v$version" --title "v$version" --generate-notes
          }
          else {
              # Append a compare link against the most recent existing tag. The v$version
              # tag does not exist yet (this step creates it), so the latest tag is the
              # previous release.
              $previousTag = git tag --list 'v*' --sort=-version:refname |
                  Where-Object { $_ -ne "v$version" } |
                  Select-Object -First 1
              if ($previousTag) {
                  $body += "`n`n**Full Changelog**: https://github.com/$env:REPOSITORY/compare/$previousTag...v$version"
              }
              Set-Content -LiteralPath './release-notes.md' -Value $body -Encoding utf8
              gh release create "v$version" --title "v$version" --notes-file './release-notes.md'
          }

      - name: Publish to PSGallery
        if: steps.check_psgallery.outputs.exists == 'false'
        shell: pwsh
        env:
          PSGALLERY_API_KEY: ${{ secrets.PSGALLERY_API_KEY }}
        run: ./build.ps1 -Task Publish -Bootstrap