release-openapi.yml

name: Release structured_params-openapi

# Publishes the structured_params-openapi gem when a GitHub Release tagged openapi-vX.Y.Z is
# published. The core gem is released by release.yml from vX.Y.Z tags.
on:
  release:
    types: [ published ]

# Both release workflows commit to main, so never run two at once.
concurrency:
  group: release-main
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write # IMPORTANT: this permission is mandatory for trusted publishing
    # Pre-releases are not published to RubyGems by this workflow.
    if: startsWith(github.event.release.tag_name, 'openapi-v') && !github.event.release.prerelease

    steps:
      - name: Checkout code
        uses: actions/checkout@v5
        with:
          ref: main
          fetch-depth: 0

      - name: Configure Git
        uses: ./.github/actions/configure-git

      - name: Extract and validate the version
        id: extract_version
        env:
          TAG_NAME: ${{ github.event.release.tag_name }}
        run: |
          VERSION=${TAG_NAME#openapi-v}
          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "::error::Release tag '$TAG_NAME' must look like openapi-vX.Y.Z"
            exit 1
          fi

          # The tagged commit must be on main, and the version must not go backwards
          # (re-running an old release must not downgrade version.rb).
          if ! git merge-base --is-ancestor "$GITHUB_SHA" HEAD; then
            echo "::error::The tagged commit is not on main"
            exit 1
          fi
          CURRENT=$(sed -n "s/.*VERSION = '\([^']*\)'.*/\1/p" structured_params-openapi/lib/structured_params/openapi/version.rb)
          if [ "$(printf '%s\n%s\n' "$CURRENT" "$VERSION" | sort -V | tail -n 1)" != "$VERSION" ]; then
            echo "::error::Version $VERSION is older than the current $CURRENT"
            exit 1
          fi
          echo "version=$VERSION" >> $GITHUB_OUTPUT

      - name: Update version file
        env:
          VERSION: ${{ steps.extract_version.outputs.version }}
        run: |
          sed -i "s/VERSION = '[^']*'/VERSION = '$VERSION'/" structured_params-openapi/lib/structured_params/openapi/version.rb
          grep -qF "VERSION = '$VERSION'" structured_params-openapi/lib/structured_params/openapi/version.rb || { echo "::error::VERSION was not updated"; exit 1; }

      - name: Update CHANGELOG
        env:
          VERSION: ${{ steps.extract_version.outputs.version }}
          TAG_NAME: ${{ github.event.release.tag_name }}
          RELEASE_NOTES: ${{ github.event.release.body }}
        run: |
          CHANGELOG=structured_params-openapi/CHANGELOG.md
          # A re-run after a failed publish must not add the entry twice.
          if grep -q "^## \[$VERSION\]" "$CHANGELOG"; then
            echo "CHANGELOG already has $VERSION"
            exit 0
          fi
          CURRENT_DATE=$(date +%Y-%m-%d)
          NOTES=$(printf '%s' "$RELEASE_NOTES" | tr -d '\r')

          # Create temporary changelog entry
          echo "## [$VERSION] - $CURRENT_DATE" > temp_changelog.md
          echo "" >> temp_changelog.md

          # Add release notes from GitHub release
          if [ -n "$NOTES" ]; then
            printf '%s\n' "$NOTES" >> temp_changelog.md
          else
            echo "- Release $TAG_NAME" >> temp_changelog.md
          fi
          echo "" >> temp_changelog.md

          # Prepend to existing CHANGELOG (skip the header)
          if [ -f "$CHANGELOG" ]; then
            tail -n +3 "$CHANGELOG" >> temp_changelog.md
          fi

          # Add header back
          echo "# Changelog" > "$CHANGELOG"
          echo "" >> "$CHANGELOG"
          cat temp_changelog.md >> "$CHANGELOG"

          rm -f temp_changelog.md

      # Committed here, pushed only after the gem has been built, so a failure
      # before that point leaves main untouched.
      - name: Commit version and CHANGELOG
        env:
          VERSION: ${{ steps.extract_version.outputs.version }}
        run: |
          git add structured_params-openapi/lib/structured_params/openapi/version.rb structured_params-openapi/CHANGELOG.md
          if git diff --staged --quiet; then
            echo "No changes to commit"
          else
            git commit -m "Update structured_params-openapi to $VERSION"
          fi

      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.4'
          bundler-cache: true

      - name: Build gem
        working-directory: structured_params-openapi
        env:
          VERSION: ${{ steps.extract_version.outputs.version }}
        run: |
          gem build structured_params-openapi.gemspec
          test -f "structured_params-openapi-$VERSION.gem"

      - name: Push the version and CHANGELOG to main
        run: git push origin main

      # The Release created its tag before the version commit. Point the tag at the commit that is
      # built and published, so the tag reproduces the gem. `rake release` then finds the tag and
      # skips tagging. Done before publishing so a refused tag push fails the job with nothing released.
      - name: Point the release tag at the published commit
        env:
          TAG_NAME: ${{ github.event.release.tag_name }}
        run: |
          git tag -f "$TAG_NAME" HEAD
          git push --force origin "refs/tags/$TAG_NAME"

      # `rake release` (see structured_params-openapi/Rakefile) tags releases openapi-vX.Y.Z. The tag exists (it was moved
      # above), so only the build and the RubyGems push happen here. That relies on the tag being
      # exactly openapi-v plus the VERSION written above, which the validation guarantees.
      - name: Publish to RubyGems
        uses: rubygems/release-gem@v1
        with:
          working-directory: structured_params-openapi