release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      bump:
        description: 'Version bump type'
        required: true
        type: choice
        options:
          - patch
          - minor
          - major
      dry-run:
        description: 'Dry run (test without publishing)'
        required: false
        type: boolean
        default: false

permissions:
  contents: read

jobs:
  release:
    name: Bump, Tag & Publish
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
        with:
          fetch-depth: 0
          token: ${{ secrets.RELEASE_TOKEN }}

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org
          cache: npm

      - run: npm ci
      - name: Build frontend
        run: cd src/frontend && npm ci && npm run build
      - run: npm test
      - run: echo "node=$(node -v) npm=$(npm -v)"

      - name: Configure git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Determine version
        id: bump
        run: |
          OLD_VERSION=$(node -p "require('./package.json').version")
          npm version ${{ inputs.bump }} --no-git-tag-version
          NEW_VERSION=$(node -p "require('./package.json').version")
          echo "Bumped ${OLD_VERSION} → ${NEW_VERSION} (${{ inputs.bump }})"
          echo "old_version=${OLD_VERSION}" >> $GITHUB_OUTPUT
          echo "new_version=${NEW_VERSION}" >> $GITHUB_OUTPUT

      - name: Update CHANGELOG
        id: changelog
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          NEW_VERSION=${{ steps.bump.outputs.new_version }}
          DATE=$(date +%Y-%m-%d)
          LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
          REPO="${{ github.repository }}"
          if [ -n "$LAST_TAG" ]; then
            COMMITS=$(gh api "/repos/${REPO}/compare/${LAST_TAG}...HEAD" \
              --jq '.commits[]
                | select(.parents | length == 1)
                | "- \(.commit.message | split("\n")[0]) (\(if .author.login then "@\(.author.login)" else .commit.author.name end))"' \
              || true)
          else
            COMMITS=$(git log --pretty=format:"- %s (%aN)" --no-merges)
          fi
          : "${COMMITS:=- Maintenance and improvements}"

          SECTION="## [${NEW_VERSION}] - ${DATE}

          ${COMMITS}"

          {
            echo "section<<CHANGELOG_EOF"
            echo "$SECTION"
            echo "CHANGELOG_EOF"
          } >> "$GITHUB_OUTPUT"

          if [ -f CHANGELOG.md ]; then
            {
              head -1 CHANGELOG.md
              echo ""
              echo "$SECTION"
              echo ""
              tail -n +2 CHANGELOG.md
            } > CHANGELOG.tmp
            mv CHANGELOG.tmp CHANGELOG.md
          fi

      - name: Commit, tag & push
        if: inputs.dry-run == false
        run: |
          NEW_VERSION=${{ steps.bump.outputs.new_version }}
          git add -A
          if git diff --cached --quiet; then
            echo "No changes to commit"
          else
            git commit -m "chore(release): v${NEW_VERSION} [skip ci]"
          fi
          if git rev-parse "v${NEW_VERSION}" >/dev/null 2>&1; then
            echo "Tag v${NEW_VERSION} already exists, skipping"
          else
            git tag -a "v${NEW_VERSION}" -m "Release v${NEW_VERSION}"
          fi
          git push origin main --follow-tags

      # npm auth: primary path is npm Trusted Publishing via OIDC (requires
      # `id-token: write` above + a Trusted Publisher configured on npmjs.com
      # for this repo + workflow path). NODE_AUTH_TOKEN is a fallback for forks
      # or environments where Trusted Publishing is not configured.
      - name: Publish to npm
        if: inputs.dry-run == false
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish --access public --provenance

      - name: Publish to npm (dry run)
        if: inputs.dry-run == true
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish --access public --provenance --dry-run

      - name: Create GitHub Release
        if: inputs.dry-run == false
        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v2
        with:
          tag_name: v${{ steps.bump.outputs.new_version }}
          name: v${{ steps.bump.outputs.new_version }}
          body: ${{ steps.changelog.outputs.section }}
          generate_release_notes: true