ci.yml

name: ci

on:
  push:
    branches:
      - main

concurrency: ${{ github.workflow }}-${{ github.ref }}

# Security: Apply principle of least privilege
# This workflow handles package publishing and documentation generation
# - release-pkg: Needs write access to create releases and publish packages
# - documentation: Uses dispatched workflow with minimal required permissions
permissions:
  contents: write  # Required for creating releases and publishing packages
  packages: write  # Required for publishing to npm
  id-token: write  # Required for OIDC token generation

jobs:
  release-pkg:
    name: Version or publish packages
    runs-on: ubuntu-latest
    # Job-specific permissions for package publishing
    permissions:
      contents: write      # Required for creating releases and pushing changes
      packages: write      # Required for publishing to npm registry
      id-token: write      # Required for OIDC token generation
      pull-requests: write # Required for changesets action to create PRs
    outputs:
      published: ${{ steps.changesets.outputs.published }}
      hasChangesets: ${{ steps.changesets.outputs.hasChangesets }}
    steps:
      # Checkout repository with full history for changeset processing
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      # Configure git user for commits made by the workflow
      - name: Configure git user (trigger actor) 
        uses: ./.github/actions/config-git-user
      
      # Install dependencies and setup Node.js environment
      - name: Setup node and install deps
        uses: ./.github/actions/node-setup

      # Process changesets: create version PR or publish packages to npm
      # This step requires write permissions to create releases and publish packages
      - name: Create Release Pull Request or Publish to npm
        id: changesets
        uses: changesets/action@v1
        with:
          title: '🤖 Bip Bop - Fusion Framework Release'
          createGithubReleases: true
          setupGitUser: false
          version: pnpm changeset:version
          publish: pnpm changeset:publish
        env:
          GITHUB_TOKEN: ${{ github.token }}
          NPM_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}

      # Convert changeset PR to draft to prevent accidental merging
      - name: convert Changeset PR to draft
        if: steps.changesets.outputs.published == 'false' && steps.changesets.outputs.pullRequestNumber
        run: gh pr ready ${{ steps.changesets.outputs.pullRequestNumber }} --undo
        env:
          GH_TOKEN: ${{ github.token }}

  # Publish the Fusion TS Lint VS Code extension to the Marketplace.
  #
  # The extension's package.json is "private" (it ships via the Marketplace,
  # not npm). `privatePackages.tag: true` (.changeset/config.json) makes
  # `changeset tag` create a git tag for it anyway on release. Rather than
  # relying on changesets/action's `publishedPackages` output (which parses
  # "New tag:" lines from that command's stdout — an implementation detail),
  # we check directly whether that tag now points at *this* commit, i.e.
  # whether this push is the exact release commit that bumped the extension.
  publish-vscode-extension:
    name: Publish VS Code extension to Marketplace
    needs: release-pkg
    runs-on: ubuntu-latest
    environment: vs-marketplace
    permissions:
      contents: read
      id-token: write  # Required for OIDC login to Azure (Marketplace publish)
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Check for a new release tag at this commit
        id: check
        run: |
          VERSION=$(node -p "require('./packages/linting/vscode/package.json').version")
          TAG="fusion-ts-lint-vscode@${VERSION}"
          TAG_SHA=$(git rev-list -n 1 "$TAG" 2>/dev/null || echo "")
          if [ "$TAG_SHA" = "$GITHUB_SHA" ]; then
            echo "should-publish=true" >> "$GITHUB_OUTPUT"
          else
            echo "should-publish=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Setup node and install deps
        if: steps.check.outputs.should-publish == 'true'
        uses: ./.github/actions/node-setup

      # Build the extension and its workspace dependencies (lsp, rules, core)
      # in the correct order — vsce does not run the "prepack" build hook.
      # The trailing "..." is required so turbo includes fusion-ts-lint-vscode's
      # dependencies in the run, not just the extension package itself.
      - name: Build extension
        if: steps.check.outputs.should-publish == 'true'
        run: pnpm turbo build --filter=fusion-ts-lint-vscode...

      - name: Azure login (Marketplace publisher identity)
        if: steps.check.outputs.should-publish == 'true'
        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43
        with:
          client-id: ${{ vars.AZURE_CLIENT_ID }}
          tenant-id: ${{ vars.AZURE_TENANT_ID }}
          allow-no-subscriptions: true

      - name: Publish to VS Code Marketplace
        if: steps.check.outputs.should-publish == 'true'
        working-directory: packages/linting/vscode
        run: pnpm exec vsce publish --no-dependencies --azure-credential

  # Update documentation only when packages are published
  # Uses dispatched workflow with minimal required permissions
  documentation:
    name: Update documentation
    permissions:
      contents: read   # Required to read repository contents
      pages: write     # Required to deploy to GitHub Pages
      id-token: write  # Required for OIDC token generation
    needs: release-pkg
    if: needs.release-pkg.outputs.published == 'true'
    uses: ./.github/workflows/generate-docs.yml
    secrets: inherit

  # Index documentation on package release
  index-docs:
    name: Index documentation
    permissions:
      contents: write
      id-token: write
    needs: release-pkg
    if: needs.release-pkg.outputs.published == 'true'
    uses: ./.github/workflows/index-docs.yml
    with:
      environment: docs
    secrets: inherit