release.yml

name: Release

on:
  push:
    branches:
      - main

permissions:
  contents: read

# GITHUB_TOKEN pushes do not recursively trigger this workflow. Protected main
# must allow GitHub Actions to write; an atomic push rejects both branch and tag
# if either update is denied.
concurrency:
  group: release-${{ github.repository }}
  cancel-in-progress: false

jobs:
  test:
    uses: ./.github/workflows/test.yml

  release:
    needs: test
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Detect release baseline
        id: baseline
        shell: bash
        run: |
          set -euo pipefail
          latest_tag=$(git tag --list --sort=-version:refname |
            grep -E '^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$' |
            head -n 1 || true)
          if [[ -n "$latest_tag" ]]; then
            echo "has_tag=true" >>"$GITHUB_OUTPUT"
          else
            echo "has_tag=false" >>"$GITHUB_OUTPUT"
          fi

      - name: Calculate conventional-commit version
        if: steps.baseline.outputs.has_tag == 'true'
        id: semver
        uses: ietf-tools/semver-action@v1
        with:
          token: ${{ github.token }}
          branch: main
          majorList: ''
          minorList: feat, feature
          patchList: fix, bugfix, perf, refactor, test, tests
          skipInvalidTags: true
          tagFilter: '^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$'
          maxTagsToFetch: 100
          noNewCommitBehavior: current
          noVersionBumpBehavior: current

      - name: Normalize release decision
        id: release
        shell: bash
        env:
          HAS_TAG: ${{ steps.baseline.outputs.has_tag }}
          BUMP: ${{ steps.semver.outputs.bump }}
          NEXT_TAG: ${{ steps.semver.outputs.next }}
          NEXT_VERSION: ${{ steps.semver.outputs.nextStrict }}
        run: |
          set -euo pipefail
          if [[ "$HAS_TAG" == false ]]; then
            tag=v0.1.0
            version=0.1.0
            should_release=true
          else
            tag=$NEXT_TAG
            version=$NEXT_VERSION
            case "$BUMP" in
              major|minor|patch) should_release=true ;;
              none) should_release=false ;;
              *) echo "Unexpected semver bump: $BUMP" >&2; exit 1 ;;
            esac
          fi
          [[ "$tag" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]
          [[ "$version" == "${tag#v}" ]]
          {
            printf 'tag=%s\n' "$tag"
            printf 'version=%s\n' "$version"
            printf 'should_release=%s\n' "$should_release"
          } >>"$GITHUB_OUTPUT"

      - name: Synchronize plugin manifests
        if: steps.release.outputs.should_release == 'true'
        env:
          VERSION: ${{ steps.release.outputs.version }}
        run: |
          set -euo pipefail
          scripts/set-plugin-version.py "$VERSION"
          python3 - "$VERSION" <<'PY'
          import json
          import sys
          from pathlib import Path

          version = sys.argv[1]
          manifest = Path("plugins/gestalt/.codex-plugin/plugin.json")
          assert json.loads(manifest.read_text())["version"] == version, manifest
          PY

      - name: Commit synchronized plugin versions
        if: steps.release.outputs.should_release == 'true'
        env:
          TAG: ${{ steps.release.outputs.tag }}
        run: |
          set -euo pipefail
          git config user.name github-actions[bot]
          git config user.email 41898282+github-actions[bot]@users.noreply.github.com
          if git diff --quiet -- plugins/gestalt/.codex-plugin/plugin.json; then
            echo "Plugin manifests already match $TAG"
          else
            git add plugins/*/.codex-plugin/plugin.json
            git commit -m "chore(release): $TAG [skip ci]"
          fi

      - name: Tag and atomically publish release
        if: steps.release.outputs.should_release == 'true'
        env:
          TAG: ${{ steps.release.outputs.tag }}
        run: |
          set -euo pipefail
          if git rev-parse --verify --quiet "refs/tags/$TAG"; then
            echo "Release tag already exists: $TAG" >&2
            exit 1
          fi
          git tag "$TAG" HEAD
          git push --atomic origin HEAD:main "refs/tags/$TAG"