release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      publish_to_npm:
        description: "Publish to npm after checks"
        type: boolean
        default: false
      npm_dist_tag:
        description: "npm dist-tag to publish under (for example: latest, next)"
        required: false
        default: "latest"
  push:
    tags:
      - "v*"

permissions:
  contents: read

concurrency:
  group: release-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  preflight:
    name: Preflight Checks
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Validate tag matches package version
        if: startsWith(github.ref, 'refs/tags/v')
        shell: bash
        run: |
          set -euo pipefail
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          PACKAGE_VERSION="$(node -p "require('./package.json').version")"
          if [[ "${TAG_VERSION}" != "${PACKAGE_VERSION}" ]]; then
            echo "Tag version (${TAG_VERSION}) does not match package.json version (${PACKAGE_VERSION})"
            exit 1
          fi

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.9

      - name: Release smoke
        run: bun run release:smoke

  package:
    name: Package Artifact
    needs: preflight
    runs-on: ubuntu-latest
    timeout-minutes: 20
    outputs:
      package_file: ${{ steps.pack.outputs.package_file }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.9

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build web
        run: bun run build:web

      - name: Packaging guard
        run: bun run pack:check:fast

      - name: Create npm tarball
        id: pack
        shell: bash
        run: |
          set -euo pipefail
          PACK_OUTPUT="$(npm pack --silent)"
          echo "${PACK_OUTPUT}"
          PACKAGE_FILE="$(printf '%s\n' "${PACK_OUTPUT}" | tail -n 1 | tr -d '\r')"
          if [[ -z "${PACKAGE_FILE}" || ! -f "${PACKAGE_FILE}" ]]; then
            echo "Unable to resolve npm pack output file"
            exit 1
          fi
          echo "package_file=${PACKAGE_FILE}" >> "$GITHUB_OUTPUT"
          shasum -a 256 "${PACKAGE_FILE}" > "${PACKAGE_FILE}.sha256"

      - name: Upload package artifact
        uses: actions/upload-artifact@v4
        with:
          name: npm-package
          path: |
            ${{ steps.pack.outputs.package_file }}
            ${{ steps.pack.outputs.package_file }}.sha256
          if-no-files-found: error

  github-release:
    name: Publish GitHub Release
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    needs: package
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
    steps:
      - name: Download package artifact
        uses: actions/download-artifact@v4
        with:
          name: npm-package
          path: dist

      - name: Create release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          files: |
            dist/*.tgz
            dist/*.tgz.sha256

  publish-npm:
    name: Publish To npm
    if: github.event_name == 'workflow_dispatch' && inputs.publish_to_npm == true
    needs: package
    runs-on: ubuntu-latest
    timeout-minutes: 20
    environment: npm-publish
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.9

      - name: Setup Node (auth preflight)
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Verify publish token presence
        shell: bash
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          set -euo pipefail
          if [[ -z "${NPM_TOKEN:-}" ]]; then
            echo "NPM_TOKEN is missing. Set it in repository/environment secrets (npm-publish)."
            exit 1
          fi

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Prepare npm registry auth
        shell: bash
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          set -euo pipefail
          AUTH_FILE="${RUNNER_TEMP}/npm-auth.npmrc"
          {
            echo "registry=https://registry.npmjs.org/"
            echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}"
            echo "always-auth=true"
          } > "${AUTH_FILE}"
          echo "NPM_CONFIG_USERCONFIG=${AUTH_FILE}" >> "${GITHUB_ENV}"

      - name: Verify npm registry auth
        run: npm whoami --registry https://registry.npmjs.org

      - name: Publish package
        shell: bash
        env:
          NPM_CONFIG_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          set -euo pipefail
          bun publish --registry https://registry.npmjs.org --access public --tag "${{ inputs.npm_dist_tag }}"