release-cli.yml

name: Release CLI

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      cli_version:
        description: Current CLI version on main to release or republish
        required: true
        type: string
      force_republish:
        description: Allow replacing assets on an existing GitHub release
        required: false
        default: false
        type: boolean

permissions:
  contents: write
  pull-requests: write

concurrency:
  group: release-cli-${{ github.ref }}
  cancel-in-progress: false

jobs:
  plan-release:
    runs-on: ubuntu-latest
    env:
      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
      TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
    outputs:
      should_release: ${{ steps.plan.outputs.should_release }}
      cli_version: ${{ steps.plan.outputs.cli_version }}
      cli_tag: ${{ steps.plan.outputs.cli_tag }}
      force_republish: ${{ steps.plan.outputs.force_republish }}
      release_ref: ${{ steps.plan.outputs.release_ref }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.10

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Sync CLI release PR
        id: changesets
        if: github.event_name == 'push'
        uses: changesets/action@v1
        with:
          version: bun run release:cli:version
          commit: "release: cli"
          title: "release: cli"
          createGithubReleases: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Detect CLI release plan
        id: plan
        shell: bash
        run: |
          event_name="${GITHUB_EVENT_NAME}"
          has_changesets="${{ steps.changesets.outputs.hasChangesets }}"
          requested_version="${{ inputs.cli_version }}"
          force_republish="${{ inputs.force_republish && 'true' || 'false' }}"
          cli_version=$(bun -e "console.log(JSON.parse(await Bun.file('./apps/cli/package.json').text()).version)")
          cli_tag="cli-v${cli_version}"
          should_release=false
          release_ref="${GITHUB_SHA}"

          tag_exists=false
          if git ls-remote --exit-code --tags origin "refs/tags/${cli_tag}" >/dev/null 2>&1; then
            tag_exists=true
          fi

          if [[ "${event_name}" == "push" ]]; then
            if [[ "${has_changesets}" == "false" ]]; then
              package_changed=false
              if git rev-parse HEAD^ >/dev/null 2>&1; then
                if ! git diff --quiet HEAD^ HEAD -- apps/cli/package.json; then
                  package_changed=true
                fi
              fi

              if [[ "$package_changed" == "true" && "$tag_exists" == "false" ]]; then
                should_release=true
              fi
            fi
          elif [[ "${event_name}" == "workflow_dispatch" ]]; then
            if [[ "${GITHUB_REF}" != "refs/heads/main" ]]; then
              echo "Manual releases only support rerunning the current CLI version from the main branch." >&2
              exit 1
            fi

            if [[ -z "${requested_version}" ]]; then
              echo "cli_version input is required." >&2
              exit 1
            fi

            if [[ "${requested_version}" != "${cli_version}" ]]; then
              echo "Requested version ${requested_version} does not match the current CLI version on main (${cli_version})." >&2
              exit 1
            fi

            should_release=true

            if [[ "${tag_exists}" == "true" ]]; then
              release_ref="${cli_tag}"
            fi
          else
            echo "Unsupported event ${event_name}." >&2
            exit 1
          fi

          echo "cli_version=${cli_version}" >> "$GITHUB_OUTPUT"
          echo "cli_tag=${cli_tag}" >> "$GITHUB_OUTPUT"
          echo "should_release=${should_release}" >> "$GITHUB_OUTPUT"
          echo "force_republish=${force_republish}" >> "$GITHUB_OUTPUT"
          echo "release_ref=${release_ref}" >> "$GITHUB_OUTPUT"

  verify:
    needs: plan-release
    if: needs.plan-release.outputs.should_release == 'true'
    runs-on: ubuntu-latest
    env:
      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
      TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ needs.plan-release.outputs.release_ref }}
          fetch-depth: 0

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.10

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Test
        run: bun run test

      - name: Verify version in tag output
        run: |
          package_version=$(bun -e "console.log(JSON.parse(await Bun.file('./apps/cli/package.json').text()).version)")

          if [[ "${package_version}" != "${{ needs.plan-release.outputs.cli_version }}" ]]; then
            echo "CLI version mismatch between planning job and workspace." >&2
            exit 1
          fi

  build:
    needs:
      - plan-release
      - verify
    if: needs.plan-release.outputs.should_release == 'true'
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: macos-15
            target: darwin-arm64
            artifact_dir: darwin-arm64
          - runner: macos-15-intel
            target: darwin-x64
            artifact_dir: darwin-x64
          - runner: ubuntu-latest
            target: linux-x64
            artifact_dir: linux-x64
          - runner: windows-latest
            target: windows-x64
            artifact_dir: windows-x64
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ needs.plan-release.outputs.release_ref }}
          fetch-depth: 0

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.10

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build CLI release binary
        env:
          SYNCDOWN_TARGET_PLATFORM: ${{ matrix.target }}
        run: bun run release:cli:binary:local

      - name: Smoke test CLI release binary
        run: bun run release:cli:binary:smoke

      - name: Upload CLI release asset
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.artifact_dir }}
          path: |
            artifacts/release/${{ matrix.artifact_dir }}/*.tar.gz
            artifacts/release/${{ matrix.artifact_dir }}/*.zip
          if-no-files-found: error

  publish-release:
    needs:
      - plan-release
      - build
    if: needs.plan-release.outputs.should_release == 'true'
    runs-on: ubuntu-latest
    env:
      CLI_TAG: ${{ needs.plan-release.outputs.cli_tag }}
      CLI_VERSION: ${{ needs.plan-release.outputs.cli_version }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ needs.plan-release.outputs.release_ref }}
          fetch-depth: 0

      - name: Create CLI tag
        run: |
          if git ls-remote --exit-code --tags origin "refs/tags/${CLI_TAG}" >/dev/null 2>&1; then
            exit 0
          fi

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git tag "${CLI_TAG}" "${GITHUB_SHA}"
          git push origin "refs/tags/${CLI_TAG}"

      - name: Inspect existing GitHub release
        id: inspect_release
        uses: actions/github-script@v7
        with:
          script: |
            try {
              const release = await github.rest.repos.getReleaseByTag({
                owner: context.repo.owner,
                repo: context.repo.repo,
                tag: process.env.CLI_TAG,
              });
              core.setOutput("exists", "true");
              core.setOutput("id", String(release.data.id));
              core.setOutput("asset_count", String(release.data.assets.length));
            } catch (error) {
              if (error.status === 404) {
                core.setOutput("exists", "false");
                core.setOutput("id", "");
                core.setOutput("asset_count", "0");
                return;
              }

              throw error;
            }

      - name: Guard against accidental republish
        if: steps.inspect_release.outputs.exists == 'true' && needs.plan-release.outputs.force_republish != 'true'
        shell: bash
        run: |
          echo "GitHub release ${CLI_TAG} already exists. Re-run workflow_dispatch with force_republish=true to replace assets." >&2
          exit 1

      - name: Delete existing release assets
        if: steps.inspect_release.outputs.exists == 'true' && needs.plan-release.outputs.force_republish == 'true'
        uses: actions/github-script@v7
        with:
          script: |
            const releaseId = Number("${{ steps.inspect_release.outputs.id }}");
            const { data: assets } = await github.rest.repos.listReleaseAssets({
              owner: context.repo.owner,
              repo: context.repo.repo,
              release_id: releaseId,
              per_page: 100,
            });

            for (const asset of assets) {
              await github.rest.repos.deleteReleaseAsset({
                owner: context.repo.owner,
                repo: context.repo.repo,
                asset_id: asset.id,
              });
            }

      - name: Download CLI release assets
        uses: actions/download-artifact@v4
        with:
          path: artifacts/release-assets

      - name: Build CLI checksum manifest
        run: |
          mkdir -p artifacts/release-assets/final
          find artifacts/release-assets -type f \( -name '*.tar.gz' -o -name '*.zip' \) -print0 \
            | sort -z \
            | xargs -0 sha256sum \
            | sed 's#artifacts/release-assets/[^/]*/##' \
            > "artifacts/release-assets/final/syncdown-${CLI_TAG}-SHA256SUMS.txt"

      - name: Read CLI changelog entry
        id: changelog
        env:
          CHANGELOG_PATH: apps/cli/CHANGELOG.md
        run: |
          node <<'EOF'
          const fs = require("node:fs");

          const changelogPath = process.env.CHANGELOG_PATH;
          const cliVersion = process.env.CLI_VERSION;
          const githubOutput = process.env.GITHUB_OUTPUT;

          if (!changelogPath || !cliVersion || !githubOutput) {
            throw new Error("Missing required environment for changelog extraction.");
          }

          if (!fs.existsSync(changelogPath)) {
            throw new Error(`Expected changelog at ${changelogPath}, but it does not exist.`);
          }

          const changelog = fs.readFileSync(changelogPath, "utf8");
          const escapedVersion = cliVersion.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
          const sectionPattern = new RegExp(
            `^##\\s+\\[?${escapedVersion}\\]?[^\\r\\n]*\\r?\\n([\\s\\S]*?)(?=^##\\s+|(?![\\s\\S]))`,
            "m",
          );
          const match = changelog.match(sectionPattern);

          if (!match) {
            throw new Error(
              `Could not find changelog section for version ${cliVersion} in ${changelogPath}.`,
            );
          }

          const releaseNotes = match[1].trim();

          if (!releaseNotes) {
            throw new Error(
              `Changelog section for version ${cliVersion} in ${changelogPath} is empty.`,
            );
          }

          fs.appendFileSync(githubOutput, `release_notes<<__CHANGELOG__\n${releaseNotes}\n__CHANGELOG__\n`);
          EOF

      - name: Publish CLI GitHub release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ env.CLI_TAG }}
          name: CLI v${{ env.CLI_VERSION }}
          body: ${{ steps.changelog.outputs.release_notes }}
          overwrite_files: true
          files: |
            artifacts/release-assets/**/*.tar.gz
            artifacts/release-assets/**/*.zip
            artifacts/release-assets/final/syncdown-${{ env.CLI_TAG }}-SHA256SUMS.txt