auto_release.yml

name: Auto Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

jobs:
  validate:
    if: "!endsWith(github.actor, '[bot]')"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # This job only reads the checked-out files, so it keeps no token in the git config.
          persist-credentials: false

      - name: Extract version from tag
        id: tag
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Validate versions match tag
        env:
          TAG_VERSION: ${{ steps.tag.outputs.version }}
        run: |
          ERRORS=""

          # Check marketplace.json metadata.version
          MKT_VERSION=$(jq -r '.metadata.version' .claude-plugin/marketplace.json)
          if [ "$MKT_VERSION" != "$TAG_VERSION" ]; then
            ERRORS+="  .claude-plugin/marketplace.json metadata.version: $MKT_VERSION\n"
          fi

          # Check each marketplace plugin entry version
          PLUGIN_COUNT=$(jq '.plugins | length' .claude-plugin/marketplace.json)
          for i in $(seq 0 $((PLUGIN_COUNT - 1))); do
            NAME=$(jq -r ".plugins[$i].name" .claude-plugin/marketplace.json)
            VER=$(jq -r ".plugins[$i].version" .claude-plugin/marketplace.json)
            if [ "$VER" != "$TAG_VERSION" ]; then
              ERRORS+="  .claude-plugin/marketplace.json plugins[$i] ($NAME): $VER\n"
            fi
          done

          # Check each plugin's plugin.json
          while IFS= read -r PLUGIN_JSON; do
            VER=$(jq -r '.version' "$PLUGIN_JSON")
            if [ "$VER" != "$TAG_VERSION" ]; then
              ERRORS+="  $PLUGIN_JSON: $VER\n"
            fi
          done < <(find . -path '*/.claude-plugin/plugin.json' -not -path './.claude-plugin/*')

          # Check package.json
          PKG_VERSION=$(jq -r '.version' package.json)
          if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then
            ERRORS+="  package.json: $PKG_VERSION\n"
          fi

          if [ -n "$ERRORS" ]; then
            echo "::error::Version mismatch! Tag is v$TAG_VERSION but these files differ:"
            echo -e "$ERRORS"
            exit 1
          fi

          echo "All versions match v$TAG_VERSION"

  release:
    needs: validate
    runs-on: ubuntu-latest
    steps:
      - name: Generate app token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ secrets.RELEASE_APP_CLIENT_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
          permission-contents: write

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          token: ${{ steps.app-token.outputs.token }}

      - name: Extract version from tag
        id: tag
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Generate release notes
        id: notes
        run: |
          NOTES=$(bash .github/scripts/generate-notes.sh "$GITHUB_REF_NAME")
          # Write to file for multi-line handling
          echo "$NOTES" > /tmp/release-notes.md

      - name: Build artifacts
        run: |
          # Each plugin.json sits at ./plugins/<name>/.claude-plugin/plugin.json; two dirnames reach the plugin root.
          while IFS= read -r PLUGIN_JSON; do
            PLUGIN_DIR=$(dirname "$(dirname "$PLUGIN_JSON")")
            PLUGIN_NAME=$(basename "$PLUGIN_DIR")

            echo "Building $PLUGIN_NAME.zip..."
            (cd "$PLUGIN_DIR" && zip -r "$GITHUB_WORKSPACE/${PLUGIN_NAME}.zip" . \
              -x "evals/*" "dist/*" ".gitignore" "*/__tests__/*")

            for SKILL_DIR in "$PLUGIN_DIR"/skills/*/; do
              [ -d "$SKILL_DIR" ] || continue
              SKILL_NAME=$(basename "$SKILL_DIR")
              echo "Building $SKILL_NAME.skill..."
              (cd "$PLUGIN_DIR/skills" && zip -r "$GITHUB_WORKSPACE/${SKILL_NAME}.skill" "$SKILL_NAME/" \
                -x "*/__tests__/*")
            done
          done < <(find . -path '*/.claude-plugin/plugin.json' -not -path './.claude-plugin/*')

      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          ARTIFACTS=$(find . -maxdepth 1 \( -name '*.skill' -o -name '*.zip' \) -print)
          gh release create "$GITHUB_REF_NAME" $ARTIFACTS \
            --title "$GITHUB_REF_NAME" \
            --notes-file /tmp/release-notes.md

      - name: Update changelog
        env:
          VERSION: ${{ steps.tag.outputs.version }}
        run: bash .github/scripts/update-changelog.sh "$VERSION" /tmp/release-notes.md

      # The tag push runs on a detached HEAD, so the changelog commit is moved onto main.
      - name: Commit changelog update
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git stash
          git checkout main
          git stash pop
          git add CHANGELOG.md
          git diff --cached --quiet && exit 0
          git commit -m "docs: update CHANGELOG.md for $GITHUB_REF_NAME"
          git push origin main