release.yml

name: Release

on:
  push:
    branches:
      - main
      - version-3.x
      - "release-*"

concurrency: ${{ github.workflow }}-${{ github.ref }}

permissions: {}

jobs:
  release:
    name: Changesets Release
    # Prevents action from creating a PR on forks
    if: github.repository == 'apollographql/apollo-client'
    runs-on: ubuntu-latest
    # Permissions necessary for Changesets to push a new branch and open PRs
    # (for automated Version Packages PRs), and request an id-token for provenance.
    # More info: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#adding-permissions-settings
    permissions:
      contents: write
      pull-requests: write
      id-token: write
    outputs:
      published: ${{ steps.changesets.outputs.published || steps.changesets-prerelease.outputs.published }}
      publishedPackages: ${{ steps.changesets.outputs.publishedPackages || steps.changesets-prerelease.outputs.publishedPackages }}
    steps:
      - name: Checkout repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          # Fetch entire git history so  Changesets can generate changelogs
          # with the correct commits
          fetch-depth: 0
          persist-credentials: false

      - name: Check for pre.json file existence
        id: check_files
        uses: andstor/file-existence-action@558493d6c74bf472d87c84eab196434afc2fa029 # v3.1.0
        with:
          files: ".changeset/pre.json"

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: "24.x"
          registry-url: "https://registry.npmjs.org"
          # deliberately not using a cache for action with elevated permissions, see https://tanstack.com/blog/npm-supply-chain-compromise-postmortem
          package-manager-cache: false

      - run: npm ci

      - name: "[main] Create release PR or publish to npm + GitHub"
        id: changesets
        if: contains(fromJSON('["main", "version-3.x"]'), github.ref_name) && steps.check_files.outputs.files_exists == 'false'
        uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # v1
        with:
          version: npm run changeset-version
          publish: npm run changeset-publish
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_TOKEN: ""

      - name: "[prerelease] Publish to npm + GitHub"
        id: changesets-prerelease
        # Only run publish if we're still in pre mode and the last commit was
        # via an automatically created Version Packages PR
        if: github.ref_name != 'main' && github.ref_name != 'version-3.x' && steps.check_files.outputs.files_exists == 'true' && startsWith(github.event.head_commit.message, 'Version Packages')
        uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # v1
        with:
          version: echo "This step should never version"
          publish: npm run changeset-publish
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_TOKEN: ""

  slack-notification:
    name: Postrelease Slack Notification
    runs-on: ubuntu-latest
    needs: release
    if: needs.release.result == 'success' && needs.release.outputs.published == 'true'
    strategy:
      matrix:
        package: ${{ fromJSON(needs.release.outputs.publishedPackages) }}
    steps:
      - name: Send a Slack notification on publish
        id: slack
        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3
        with:
          # Slack channel id, channel name, or user id to post message
          # See also: https://api.slack.com/methods/chat.postMessage#channels
          # You can pass in multiple channels to post to by providing
          # a comma-delimited list of channel IDs
          channel-id: "C01PS0CB41G"
          payload: |
            {
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "A new version of `{{ matrix.package.name }}` was released :rocket:"
                  }
                },
                {
                  "type": "section",
                  "fields": [
                    {
                      "type": "mrkdwn",
                      "text": "*Version:*\n`${{ matrix.package.version }}`"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Tag:*\n`${{ github.ref_name == 'main' && 'latest' || 'next' }}`"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*GitHub release:*\n<https://github.com/apollographql/apollo-client/releases/tag/${{ matrix.package.name }}@${{ matrix.package.version }}|link>"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*npm releases:*\n<https://www.npmjs.com/package/@apollo/client?activeTab=versions|link>"
                    }
                  ]
                }
              ]
            }
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}

  tag-next:
    name: Postrelease Tag Next Release
    runs-on: ubuntu-latest
    needs: release
    if: github.ref_name != 'main' && github.ref_name != 'version-3.x' && needs.release.result == 'success' && needs.release.outputs.published == 'true'
    permissions:
      id-token: write
    strategy:
      matrix:
        package: ${{ fromJSON(needs.release.outputs.publishedPackages) }}
    steps:
      - name: Checkout repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: "24.x"
          registry-url: "https://registry.npmjs.org"
          # deliberately not using a cache for action with elevated permissions, see https://tanstack.com/blog/npm-supply-chain-compromise-postmortem
          package-manager-cache: false

      - run: npm ci

      - name: Tag release with next on npm
        run: |
          if NEXT=$(npm show ${{ matrix.package.name }}@next version) node -e 'process.exit(require("semver").gt("${{ matrix.package.version }}",process.env.NEXT)?0:1)'; then
            npm dist-tag add ${{ matrix.package.name }}@${{ matrix.package.version }} next;
          fi

  devtools-errorcodes:
    name: Trigger Devtools Error Code Update
    needs: release
    if: needs.release.result == 'success' && needs.release.outputs.published == 'true'
    runs-on: ubuntu-latest
    permissions: {}
    steps:
      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 #v3
        id: github-actions-bot-app-token
        with:
          app-id: 819772
          private-key: ${{ secrets.APOLLO_GITHUB_ACTIONS_BOT_PRIVATE_KEY }}
          repositories: apollo-client-devtools
      - uses: benc-uk/workflow-dispatch@7a027648b88c2413826b6ddd6c76114894dc5ec4 #v1
        with:
          workflow: update-errorcodes.yml
          repo: apollographql/apollo-client-devtools
          token: ${{ steps.github-actions-bot-app-token.outputs.token }}