release.yml

name: Release

on:
  push:
    branches:
      - main

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      id-token: write
    outputs:
      version: ${{ steps.version.outputs.version }}
      tag: ${{ steps.version.outputs.tag }}
      skip: ${{ steps.version.outputs.skip }}
    steps:
      - name: Generate GitHub App token
        id: generate-token
        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
        with:
          app-id: ${{ secrets.GH_APP_ID }}
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

      - name: Run release-please
        uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
        id: release
        with:
          token: ${{ steps.generate-token.outputs.token }}

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Determine version
        id: version
        env:
          RELEASE_CREATED: ${{ steps.release.outputs.release_created }}
          RELEASE_VERSION: ${{ steps.release.outputs.major }}.${{ steps.release.outputs.minor }}.${{ steps.release.outputs.patch }}
          PR_HEAD_BRANCH: ${{ steps.release.outputs.pr && fromJSON(steps.release.outputs.pr).headBranchName }}
          RUN_NUMBER: ${{ github.run_number }}
        run: |
          set -euo pipefail

          if [ "$RELEASE_CREATED" == "true" ]; then
            VERSION="$RELEASE_VERSION"
            TAG="latest"
          else
            if [ -z "$PR_HEAD_BRANCH" ]; then
              echo "skip=true" >> $GITHUB_OUTPUT
              exit 0
            fi

            # Validate branch name to prevent git ref injection
            if [[ ! "$PR_HEAD_BRANCH" =~ ^[A-Za-z0-9._/-]+$ ]] || \
               [[ "$PR_HEAD_BRANCH" =~ \.\.|//|@\{|^-|/$ ]]; then
              echo "Invalid PR_HEAD_BRANCH: $PR_HEAD_BRANCH"
              exit 1
            fi

            git fetch origin "refs/heads/$PR_HEAD_BRANCH"
            NEXT_VERSION=$(git show "FETCH_HEAD:package.json" | node -p "JSON.parse(require('fs').readFileSync(0,'utf8')).version")

            if [[ ! "$NEXT_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
              echo "Invalid version in PR branch package.json: $NEXT_VERSION"
              exit 1
            fi

            VERSION="${NEXT_VERSION}-rc.${RUN_NUMBER}"
            TAG="rc"
          fi
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "tag=$TAG" >> $GITHUB_OUTPUT

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        if: ${{ steps.version.outputs.skip != 'true' }}
        with:
          node-version: 22

      - name: Setup pnpm
        uses: pnpm/action-setup@8912a9102ac27614460f54aedde9e1e7f9aec20d # v6.0.5
        if: ${{ steps.version.outputs.skip != 'true' }}

      - name: Install dependencies
        if: ${{ steps.version.outputs.skip != 'true' }}
        run: pnpm install --frozen-lockfile

      - name: Stamp version
        if: ${{ steps.version.outputs.skip != 'true' }}
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: npm version "$VERSION" --no-git-tag-version --allow-same-version

      - name: Build
        if: ${{ steps.version.outputs.skip != 'true' }}
        run: pnpm build

      - name: Pack tarball
        if: ${{ steps.version.outputs.skip != 'true' }}
        run: |
          mkdir -p ./pack
          npm pack --pack-destination ./pack
          ls -la ./pack/

      - name: Upload tarball artifact
        if: ${{ steps.version.outputs.skip != 'true' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: npm-tarball
          path: ./pack/*.tgz
          retention-days: 1
          if-no-files-found: error

      - name: Create GitHub pre-release
        if: ${{ steps.version.outputs.tag == 'rc' }}
        env:
          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          gh release create "server-v$VERSION" \
            --title "server-v$VERSION" \
            --generate-notes \
            --prerelease

  # A sibling of publish-npm rather than a step inside build: the two registries
  # fail independently, and a rejected JSR upload must not withhold the npm
  # release. Gated to real releases, so no RC ever lands in the JSR version list.
  publish-jsr:
    runs-on: ubuntu-latest
    needs: build
    if: ${{ needs.build.outputs.skip != 'true' && needs.build.outputs.tag == 'latest' }}
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22

      - name: Setup pnpm
        uses: pnpm/action-setup@8912a9102ac27614460f54aedde9e1e7f9aec20d # v6.0.5

      # jsr publish resolves bare specifiers through node_modules before upload.
      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Publish to JSR
        run: npx jsr@0.14.3 publish --allow-dirty

  publish-npm:
    runs-on: ubuntu-latest
    needs: build
    if: ${{ needs.build.outputs.skip != 'true' }}
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          registry-url: 'https://registry.npmjs.org'

      - name: Install latest npm (user prefix)
        run: |
          mkdir -p "$HOME/.npm-global"
          npm config set prefix "$HOME/.npm-global"
          echo "$HOME/.npm-global/bin" >> "$GITHUB_PATH"

          npm install -g npm@latest
          npm --version

      - name: Download tarball artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: npm-tarball
          path: ./publish

      - name: Publish to npm
        env:
          VERSION: ${{ needs.build.outputs.version }}
          TAG: ${{ needs.build.outputs.tag }}
        run: |
          set -euo pipefail
          NPM_VIEW_STDERR=$(mktemp)
          EXISTING=$(npm view "@supabase/server@$VERSION" version 2>"$NPM_VIEW_STDERR") || STATUS=$?
          if [ -n "$EXISTING" ]; then
            echo "Version $VERSION already published, skipping."
            rm -f "$NPM_VIEW_STDERR"
            exit 0
          elif [ "${STATUS:-0}" -ne 0 ] && ! grep -qiE 'E404|not found' "$NPM_VIEW_STDERR"; then
            cat "$NPM_VIEW_STDERR"
            rm -f "$NPM_VIEW_STDERR"
            exit 1
          fi
          rm -f "$NPM_VIEW_STDERR"
          npm publish ./publish/*.tgz --access public --provenance --tag "$TAG"