release.yml

---
name: Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: Release version without the v prefix.
        required: true
        type: string
      ref:
        description: Branch, tag, or SHA to release.
        required: false
        default: master
        type: string
      publish_github_release:
        description: Create or update the GitHub Release.
        required: false
        default: true
        type: boolean
      publish_pypi:
        description: Publish distributions to PyPI.
        required: false
        default: true
        type: boolean

concurrency:
  group: npmctl-release-${{ inputs.version }}
  cancel-in-progress: false

permissions:
  actions: write
  contents: write
  id-token: write

jobs:
  prepare:
    runs-on:
      group: shortlived
    outputs:
      target_ref: ${{ steps.target.outputs.ref }}
      target_sha: ${{ steps.final-target.outputs.sha }}
      tag_name: ${{ steps.prepare.outputs.tag-name }}
      release_name: ${{ steps.prepare.outputs.release-name }}
      release_notes: ${{ steps.prepare.outputs.release-notes }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.ref }}
          fetch-depth: 0
      - uses: ./.github/actions/setup-uv-python

      - name: Resolve target ref
        id: target
        shell: bash
        run: |
          set -euo pipefail
          echo "ref=${{ inputs.ref }}" >> "$GITHUB_OUTPUT"
          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

      - name: Bump release metadata
        shell: bash
        env:
          VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          cat > /tmp/npmctl-bump-version.py <<'PY'
          import os
          import re
          from pathlib import Path

          version = os.environ["VERSION"]
          version_paths = [
              Path("pyproject.toml"),
              Path("packages/npmctl/pyproject.toml"),
              Path("packages/npmctl-cloudflare/pyproject.toml"),
              Path("packages/npmctl-digitalocean/pyproject.toml"),
              Path("packages/npmctl-godaddy/pyproject.toml"),
              Path("packages/npmctl-namecheap/pyproject.toml"),
              Path("packages/npmctl-route53/pyproject.toml"),
          ]
          for path in version_paths:
              text = path.read_text(encoding="utf-8")
              text = re.sub(
                  r'(^version\s*=\s*)["\'][^"\']*["\']',
                  rf'\1"{version}"',
                  text,
                  count=1,
                  flags=re.M,
              )
              path.write_text(text, encoding="utf-8")
          init = Path("packages/npmctl/src/npmctl/__init__.py")
          text = init.read_text(encoding="utf-8")
          text = re.sub(
              r'(__version__\s*=\s*)["\'][^"\']*["\']',
              rf'\1"{version}"',
              text,
          )
          init.write_text(text, encoding="utf-8")
          PY
          python /tmp/npmctl-bump-version.py

      - name: Commit release metadata
        shell: bash
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add \
            pyproject.toml \
            packages/npmctl/pyproject.toml \
            packages/npmctl-cloudflare/pyproject.toml \
            packages/npmctl-digitalocean/pyproject.toml \
            packages/npmctl-godaddy/pyproject.toml \
            packages/npmctl-namecheap/pyproject.toml \
            packages/npmctl-route53/pyproject.toml \
            packages/npmctl/src/npmctl/__init__.py
          if git diff --cached --quiet; then
            exit 0
          fi
          git commit -m "Release npmctl ${{ inputs.version }}"
          git push

      - name: Refresh target SHA after release commit
        id: final-target
        shell: bash
        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

      - name: Prepare release metadata
        id: prepare
        shell: bash
        run: |
          set -euo pipefail
          notes="release-notes.md"
          echo "Release npmctl v${{ inputs.version }}" > "$notes"
          echo "tag-name=v${{ inputs.version }}" >> "$GITHUB_OUTPUT"
          echo "release-name=npmctl v${{ inputs.version }}" >> "$GITHUB_OUTPUT"
          echo "release-notes=$notes" >> "$GITHUB_OUTPUT"

      - name: Verify synchronized package versions and publish compatibility matrix
        shell: bash
        env:
          VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
          uv run python - <<'PY'
          import os
          import tomllib
          from pathlib import Path

          expected = os.environ["VERSION"]
          paths = [Path("pyproject.toml"), *sorted(Path("packages").glob("*/pyproject.toml"))]
          versions = {str(path): tomllib.loads(path.read_text(encoding="utf-8"))["project"]["version"] for path in paths}
          mismatches = {path: value for path, value in versions.items() if value != expected}
          if mismatches:
              raise SystemExit(f"workspace versions are not synchronized: {mismatches}")
          PY
          uv run npmctl --output json contract list > contract-compatibility-matrix.json
          uv run npmctl migrate examples/desired-state --check

      - uses: actions/upload-artifact@v4
        with:
          name: npmctl-contract-compatibility
          path: contract-compatibility-matrix.json

      - uses: actions/upload-artifact@v4
        with:
          name: npmctl-release-notes
          path: ${{ steps.prepare.outputs.release-notes }}

  gates:
    needs: prepare
    runs-on:
      group: shortlived
    steps:
      - name: Install GitHub CLI
        shell: bash
        run: |
          if command -v gh >/dev/null 2>&1; then
            exit 0
          fi
          asset_url="$(curl -fsSL https://api.github.com/repos/cli/cli/releases/latest | grep -o 'https://[^" ]*gh_[^" ]*_linux_amd64.tar.gz' | head -n 1)"
          test -n "$asset_url"
          curl -fsSL "$asset_url" -o /tmp/gh.tar.gz
          tar -xzf /tmp/gh.tar.gz -C /tmp
          gh_dir="$(find /tmp -maxdepth 1 -type d -name 'gh_*_linux_amd64' | head -n 1)"
          test -n "$gh_dir"
          echo "$gh_dir/bin" >> "$GITHUB_PATH"

      - name: Dispatch and wait for release gates
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          TARGET_REF: ${{ needs.prepare.outputs.target_ref }}
          TARGET_SHA: ${{ needs.prepare.outputs.target_sha }}
        shell: bash
        run: |
          set -euo pipefail

          wait_for_success() {
            local workflow="$1"
            local label="$2"
            local started="$3"
            local deadline=$((SECONDS + 3600))
            local run_id=""

            while (( SECONDS < deadline )); do
              run_id="$(gh run list --repo "$REPO" --workflow "$workflow" \
                --json databaseId,headSha,status,conclusion,createdAt --limit 50 \
                --jq '[.[] | select(.headSha == env.TARGET_SHA and .createdAt >= "'"$started"'")] | sort_by(.createdAt) | last | .databaseId // ""')"
              if [[ -n "$run_id" ]]; then
                status="$(gh run view "$run_id" --repo "$REPO" --json status --jq .status)"
                conclusion="$(gh run view "$run_id" --repo "$REPO" --json conclusion --jq '.conclusion // ""')"
                if [[ "$status" == "completed" ]]; then
                  if [[ "$conclusion" == "success" ]]; then
                    echo "$label succeeded: $run_id"
                    return 0
                  fi
                  echo "$label failed: $run_id ($conclusion)" >&2
                  exit 1
                fi
              fi
              sleep 20
            done
            echo "$label did not complete before timeout" >&2
            exit 1
          }

          ci_started="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          gh workflow run ci.yml --repo "$REPO" --ref "$TARGET_REF"
          wait_for_success ci.yml "CI" "$ci_started"

          docs_started="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          gh workflow run docs-ssot.yml --repo "$REPO" --ref "$TARGET_REF"
          wait_for_success docs-ssot.yml "Docs and SSOT" "$docs_started"

          python_started="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          gh workflow run python-matrix.yml --repo "$REPO" --ref "$TARGET_REF"
          wait_for_success python-matrix.yml "Python Matrix" "$python_started"

          live_started="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          gh workflow run live-npm-gate.yml --repo "$REPO" --ref "$TARGET_REF"
          wait_for_success live-npm-gate.yml "Live NPM Gate" "$live_started"

  build:
    needs: [prepare, gates]
    runs-on:
      group: shortlived
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.prepare.outputs.target_sha }}
      - uses: ./.github/actions/setup-uv-python
      - uses: ./.github/actions/npmctl-release-build

  publish:
    needs: [prepare, build]
    runs-on:
      group: shortlived
    environment: pypi
    steps:
      - uses: actions/setup-python@v5
        with:
          python-version: "3.13"
      - uses: actions/download-artifact@v4
        with:
          name: npmctl-dist
          path: dist
      - uses: actions/download-artifact@v4
        with:
          name: npmctl-release-notes
          path: .tmp/release

      - name: Remove distribution directory placeholder
        shell: bash
        run: rm -f dist/.gitignore

      - name: Publish distributions to PyPI with Trusted Publishing
        id: pypi-trusted-publishing
        uses: cobycloud/actions/actions/pypi-trusted-publish@main
        if: inputs.publish_pypi
        continue-on-error: true
        with:
          packages-dir: dist
          skip-existing: true

      - name: Publish distributions to PyPI with API token fallback
        if: inputs.publish_pypi && steps.pypi-trusted-publishing.outcome == 'failure'
        uses: cobycloud/actions/actions/pypi-token-publish@main
        with:
          api-token: ${{ secrets.PYPI_API_TOKEN }}
          packages-dir: dist
          skip-existing: true

      - uses: softprops/action-gh-release@v2
        if: >
          inputs.publish_github_release && (
            !inputs.publish_pypi ||
            steps.pypi-trusted-publishing.outcome == 'success' ||
            steps.pypi-trusted-publishing.outcome == 'failure'
          )
        with:
          tag_name: ${{ needs.prepare.outputs.tag_name }}
          name: ${{ needs.prepare.outputs.release_name }}
          body_path: .tmp/release/release-notes.md
          files: dist/*