release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write
  packages: write
  id-token: write

env:
  NODE_VERSION: "22"
  PNPM_VERSION: "9.15.0"
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  validate:
    name: Validate Tag
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - uses: actions/checkout@v4

      - name: Extract version from tag
        id: version
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Validate semver
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]]; then
            echo "::error::Invalid semver tag: $VERSION"
            exit 1
          fi

  build:
    name: Build Packages
    runs-on: ubuntu-latest
    needs: [validate]
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
        with:
          version: ${{ env.PNPM_VERSION }}

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm
          registry-url: "https://registry.npmjs.org"

      - run: pnpm install --frozen-lockfile
      - run: pnpm build

      - name: Verify build artifacts
        run: |
          test -d packages/shared/dist
          test -d packages/core/dist
          test -d packages/sdk/dist
          test -d packages/x402-compliance/dist
          test -d packages/mcp-server/dist

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: release-build
          path: |
            packages/*/dist
            packages/*/package.json
            apps/api/dist

  publish-npm:
    name: Publish to npm
    runs-on: ubuntu-latest
    needs: [build]
    strategy:
      fail-fast: true
      max-parallel: 1
      matrix:
        package:
          - packages/shared
          - packages/core
          - packages/x402-compliance
          - packages/mcp-server
          - packages/sdk
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
        with:
          version: ${{ env.PNPM_VERSION }}

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm
          registry-url: "https://registry.npmjs.org"

      - run: pnpm install --frozen-lockfile

      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: release-build

      - name: Set package version
        working-directory: ${{ matrix.package }}
        run: npm version ${{ needs.build.outputs.version || github.ref_name }} --no-git-tag-version --allow-same-version 2>/dev/null || true

      - name: Publish
        working-directory: ${{ matrix.package }}
        run: pnpm publish --access public --no-git-checks
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

  docker:
    name: Build & Push Docker Image
    runs-on: ubuntu-latest
    needs: [build]
    steps:
      - uses: actions/checkout@v4

      - uses: docker/setup-buildx-action@v3

      - name: Log in to Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=raw,value=latest

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          target: production
          platforms: linux/amd64,linux/arm64

  github-release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    needs: [publish-npm, docker]
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Generate changelog
        id: changelog
        run: |
          PREV_TAG=$(git tag --sort=-v:refname | head -2 | tail -1)
          if [ -z "$PREV_TAG" ]; then
            CHANGELOG=$(git log --pretty=format:"- %s (%h)" HEAD)
          else
            CHANGELOG=$(git log --pretty=format:"- %s (%h)" "${PREV_TAG}..HEAD")
          fi
          echo "changelog<<EOF" >> "$GITHUB_OUTPUT"
          echo "$CHANGELOG" >> "$GITHUB_OUTPUT"
          echo "EOF" >> "$GITHUB_OUTPUT"

      - name: Create release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          body: |
            ## What's Changed

            ${{ steps.changelog.outputs.changelog }}

            ## Packages Published

            | Package | Version |
            |---------|---------|
            | `@prooflink/shared` | ${{ github.ref_name }} |
            | `@prooflink/core` | ${{ github.ref_name }} |
            | `@prooflink/x402-compliance` | ${{ github.ref_name }} |
            | `@prooflink/mcp-server` | ${{ github.ref_name }} |
            | `@prooflink/sdk` | ${{ github.ref_name }} |

            ## Docker Image

            ```
            docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }}
            ```
          prerelease: ${{ contains(github.ref_name, '-') }}