release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

permissions: {}

jobs:
  security:
    name: Security
    uses: ./.github/workflows/security.yml
    permissions:
      contents: read
      security-events: write
      pull-requests: read

  test:
    name: Test gate
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache
        with:
          go-version-file: go.mod

      - name: Install golangci-lint
        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
        with:
          version: v2.9.0
          install-only: true

      - name: Check formatting
        run: test -z "$(gofmt -l .)" || (echo "Run 'gofmt -w .' to fix formatting" && gofmt -l . && exit 1)

      - name: Vet
        run: go vet ./...

      - name: Lint
        run: golangci-lint run

      - name: Check go.mod tidiness
        run: |
          go mod tidy
          git diff --exit-code go.mod go.sum

      - name: Test
        run: go test -v ./...

      - name: Test (race detector)
        run: go test -race -count=1 ./...

      - name: Govulncheck
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck ./...

      - name: Verify tag is on main
        env:
          COMMIT_SHA: ${{ github.sha }}
        run: |
          git fetch origin main
          if ! git merge-base --is-ancestor "$COMMIT_SHA" origin/main; then
            echo "Error: tag is not on the main branch"
            exit 1
          fi

  publish:
    name: Publish
    runs-on: ubuntu-latest
    needs: [test, security]
    environment: release
    permissions:
      contents: write
      models: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Verify tag is on main
        env:
          COMMIT_SHA: ${{ github.sha }}
        run: |
          git fetch origin main
          if ! git merge-base --is-ancestor "$COMMIT_SHA" origin/main; then
            echo "Error: tag is not on the main branch"
            exit 1
          fi

      - name: Build changelog context
        run: |
          PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
          DIFF_FILE=/tmp/diff.txt
          if [ -z "$PREV_TAG" ]; then
            COMMITS=$(git log --oneline --no-decorate)
            git diff --stat 4b825dc642cb6eb9a060e54bf899d69f82a3ef17 HEAD > "$DIFF_FILE"
          else
            COMMITS=$(git log --oneline --no-decorate "${PREV_TAG}..HEAD")
            git diff "${PREV_TAG}..HEAD" -- '*.go' 'go.mod' > "$DIFF_FILE"
          fi
          {
            echo "Commits:"
            echo "$COMMITS"
            echo ""
            echo "Diff summary:"
            head -c 80000 "$DIFF_FILE"
          } > /tmp/user-message.txt
          # Splice into prompt YAML
          python3 -c "
          with open('.github/prompts/summarize-changelog.prompt.yml') as f:
              lines = f.readlines()
          with open('/tmp/user-message.txt') as f:
              user_msg = f.read()
          insert_at = len(lines)
          for i, line in enumerate(lines):
              if i == 0: continue
              if line.strip() and not line[0].isspace():
                  insert_at = i
                  break
          entry = ['  - role: user\n', '    content: |\n']
          for ln in user_msg.splitlines():
              entry.append('      ' + ln + '\n')
          lines[insert_at:insert_at] = entry
          with open('/tmp/prompt.yml', 'w') as f:
              f.writelines(lines)
          try:
              import yaml
              doc = yaml.safe_load(open('/tmp/prompt.yml'))
              assert doc['messages'][-1]['role'] == 'user', 'prompt splice failed'
          except ImportError:
              pass
          "
        continue-on-error: true

      - name: Generate AI changelog
        id: ai-changelog
        uses: actions/ai-inference@e09e65981758de8b2fdab13c2bfb7c7d5493b0b6 # v2.0.7
        continue-on-error: true
        with:
          prompt-file: /tmp/prompt.yml

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CHANGELOG_FILE: ${{ steps.ai-changelog.outputs.response-file }}
          TAG: ${{ github.ref_name }}
        run: |
          NOTES=""
          if [ -n "$CHANGELOG_FILE" ] && [ -f "$CHANGELOG_FILE" ]; then
            sed -i '/^```\(markdown\)\?$/d' "$CHANGELOG_FILE"
            CHANGELOG=$(cat "$CHANGELOG_FILE")
            if [ -n "$CHANGELOG" ]; then
              NOTES="${CHANGELOG}

          ---

          "
            fi
          fi
          NOTES="${NOTES}### Install

          \`\`\`
          go get github.com/basecamp/cli@${TAG}
          \`\`\`"

          if [[ "$TAG" == *"-"* ]]; then
            PRERELEASE="--prerelease"
          else
            PRERELEASE=""
          fi

          gh release create "$TAG" \
            --title "v${TAG#v}" \
            --notes "$NOTES" \
            --generate-notes \
            $PRERELEASE

  sync-skills:
    name: Sync skills
    runs-on: ubuntu-latest
    needs: [publish]
    if: vars.SKILLS_APP_ID != ''
    continue-on-error: true
    timeout-minutes: 5
    environment: release
    concurrency:
      group: sync-skills
      cancel-in-progress: false
    permissions:
      contents: read
    env:
      HAS_SKILLS_KEY: ${{ secrets.SKILLS_APP_PRIVATE_KEY && 'true' || '' }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Check prerequisites
        id: check
        run: |
          if [ -z "$HAS_SKILLS_KEY" ]; then
            echo "::warning::SKILLS_APP_PRIVATE_KEY secret is not set — skipping skills sync"
            echo "ready=false" >> "$GITHUB_OUTPUT"
          elif ! ls skills/*/SKILL.md >/dev/null 2>&1; then
            echo "No skill files found — skipping sync"
            echo "ready=false" >> "$GITHUB_OUTPUT"
          else
            echo "ready=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Generate token
        if: steps.check.outputs.ready == 'true'
        id: skills-token
        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
        with:
          app-id: ${{ vars.SKILLS_APP_ID }}
          private-key: ${{ secrets.SKILLS_APP_PRIVATE_KEY }}
          owner: basecamp
          repositories: skills

      - name: Sync skills
        if: steps.check.outputs.ready == 'true'
        env:
          CLI_NAME: cli
          SKILLS_TOKEN: ${{ steps.skills-token.outputs.token }}
          RELEASE_TAG: ${{ github.ref_name }}
          SOURCE_SHA: ${{ github.sha }}
        run: scripts/sync-skills.sh