publish-to-public.yml

name: Publish to Public Repository

# Trigger options:
# 1. On GitHub release published (automatic after auto-release.yaml creates release)
# 2. On push to 'ready-for-public' branch (create this branch with protections)
# 3. Manual trigger via GitHub Actions UI
#
# NOTE: We trigger on 'release' events instead of 'push: tags' because
# the auto-release workflow uses GITHUB_TOKEN to push tags, which won't
# trigger other workflows (GitHub security feature to prevent infinite loops).
# By triggering on 'release' events, we run automatically when the GitHub
# release is created.

on:
  release:
    types: [published]  # Triggers when auto-release.yaml creates a GitHub release
  push:
    branches:
      - 'ready-for-public'  # Protected branch for controlled releases
  workflow_dispatch:    # Manual trigger from GitHub UI

env:
  PUBLIC_REPO: 'ericscheier/emburden'
  PUBLIC_BRANCH: 'main'

jobs:
  publish:
    name: Clean and publish to public repository
    runs-on: ubuntu-latest
    environment:
      name: public-release
      url: https://github.com/${{ env.PUBLIC_REPO }}

    steps:
      - name: Checkout private repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Full history for proper git operations
          persist-credentials: false  # Don't persist GitHub Actions token

      - name: Configure git
        run: |
          git config user.name "Eric Scheier"
          git config user.email "eric@scheier.org"

      - name: Install git-filter-repo
        run: |
          python3 -m pip install --user git-filter-repo

      - name: Filter AI attributions from commit messages
        run: |
          echo "Rewriting commit history to remove AI attributions..."

          # Create Python script to filter commit messages
          cat > /tmp/filter-commit-messages.py <<'PYTHON_EOF'
          #!/usr/bin/env python3
          import re
          import sys

          # Read the commit message
          message = sys.stdin.buffer.read().decode('utf-8')

          # Remove AI attribution lines
          # Pattern 1: Full attribution block with emoji and Co-Authored-By
          message = re.sub(r'\n\n🤖 Generated with \[Claude Code\]\(https://claude\.com/claude-code\)\n\nCo-Authored-By: Claude <noreply@anthropic\.com>\n?', '', message)

          # Pattern 2: Just the Claude Code line
          message = re.sub(r'\n\n🤖 Generated with \[Claude Code\]\(https://claude\.com/claude-code\)\n?', '', message)

          # Pattern 3: Just the Co-Authored-By line
          message = re.sub(r'\n\nCo-Authored-By: Claude <noreply@anthropic\.com>\n?', '', message)

          # Clean up any trailing whitespace and multiple blank lines
          message = re.sub(r'\n\n\n+', '\n\n', message)
          message = message.rstrip() + '\n'

          # Output the cleaned message
          sys.stdout.buffer.write(message.encode('utf-8'))
          PYTHON_EOF

          chmod +x /tmp/filter-commit-messages.py

          # Apply filter to all commits
          ~/.local/bin/git-filter-repo --force \
            --commit-callback "$(cat <<'CALLBACK_EOF'
          import subprocess

          # Get the original message
          original_msg = commit.message.decode('utf-8')

          # Filter it through our Python script
          result = subprocess.run(
              ['/tmp/filter-commit-messages.py'],
              input=original_msg.encode('utf-8'),
              capture_output=True
          )

          # Update the commit message
          commit.message = result.stdout
          CALLBACK_EOF
          )"

          echo "✓ Commit history rewritten - AI attributions removed"

      - name: Clean repository for public release
        run: |
          echo "Cleaning repository for public distribution..."

          # Remove .private/ directory
          if [ -d ".private" ]; then
            rm -rf .private/
            echo "✓ Removed .private/ directory"
          fi

          # Remove log files
          find . -name "*.log" -type f -delete 2>/dev/null || true
          echo "✓ Removed *.log files"

          # Remove cache directories
          find . -name "*_cache" -type d -exec rm -rf {} + 2>/dev/null || true
          echo "✓ Removed *_cache directories"

          # Remove output directories
          find . -name "*_files" -type d -exec rm -rf {} + 2>/dev/null || true
          echo "✓ Removed *_files directories"

          # Remove workflow file itself (don't want this in public repo)
          rm -f .github/workflows/publish-to-public.yml
          echo "✓ Removed workflow file"

          echo ""
          echo "Files cleaned. Current status:"
          git status --short || true

      - name: Check if there are changes to commit
        id: check_changes
        run: |
          if [[ -n $(git status --porcelain) ]]; then
            echo "has_changes=true" >> $GITHUB_OUTPUT
          else
            echo "has_changes=false" >> $GITHUB_OUTPUT
          fi

      - name: Commit cleaned changes
        if: steps.check_changes.outputs.has_changes == 'true'
        run: |
          git add -A

          # Create commit message with cleaned attribution
          cat > /tmp/commit_msg.txt <<'EOF'
          Prepare for public release

          Remove private development files and prepare repository
          for public distribution.
          EOF

          git commit -F /tmp/commit_msg.txt
          echo "✓ Changes committed"

      - name: Push to public repository
        env:
          GITHUB_TOKEN: ${{ secrets.PUBLIC_REPO_TOKEN }}
        run: |
          # Add public remote with token embedded
          git remote add public https://x-access-token:${GITHUB_TOKEN}@github.com/${PUBLIC_REPO}.git

          # Push to public repository
          # Use --force since we're rewriting history and don't have remote tracking
          GIT_ASKPASS=true git push public HEAD:${PUBLIC_BRANCH} --force

          echo ""
          echo "================================================================"
          echo "  Successfully published to ${PUBLIC_REPO}"
          echo "================================================================"
          echo ""
          echo "Public repository: https://github.com/${PUBLIC_REPO}"
          echo "Branch: ${PUBLIC_BRANCH}"

          # If triggered by tag, also push the tag
          if [[ "$GITHUB_REF" == refs/tags/* ]]; then
            TAG_NAME=${GITHUB_REF#refs/tags/}
            echo "Pushing tag: ${TAG_NAME}"
            git push public ${TAG_NAME} || echo "Note: Tag may already exist on public repo"
          fi

      - name: Create GitHub release on public repo
        if: startsWith(github.ref, 'refs/tags/v')
        env:
          GITHUB_TOKEN: ${{ secrets.PUBLIC_REPO_TOKEN }}
          GH_REPO: ${{ env.PUBLIC_REPO }}
        run: |
          # Extract version from tag
          TAG_NAME=${GITHUB_REF#refs/tags/}
          VERSION=${TAG_NAME#v}

          echo "Creating release for version: $VERSION"

          # Extract release notes from NEWS.md
          if [ -f "NEWS.md" ]; then
            # Extract the section for this version
            awk "/^# emburden $VERSION/,/^# emburden [0-9]/" NEWS.md | head -n -1 > /tmp/release-notes.md

            # If no release notes found, use a default message
            if [ ! -s /tmp/release-notes.md ]; then
              echo "Release notes not found in NEWS.md for version $VERSION" > /tmp/release-notes.md
            fi
          else
            echo "Release notes not available (NEWS.md not found)" > /tmp/release-notes.md
          fi

          # Append installation and citation information
          cat >> /tmp/release-notes.md <<EOF

          ---

          ## Installation

          \`\`\`r
          # Install from GitHub
          # install.packages("remotes")
          remotes::install_github("${PUBLIC_REPO}@${TAG_NAME}")
          \`\`\`

          ## Citation

          If you use this package or methodology in your research, please cite:

          **Scheier, E., & Kittner, N. (2022). A measurement strategy to address disparities across household energy burdens. _Nature Communications_, 13, 1717. https://doi.org/10.1038/s41467-021-27673-y**
          EOF

          # Create the release on public repo
          gh release create "${TAG_NAME}" \
            --repo "${PUBLIC_REPO}" \
            --title "emburden ${TAG_NAME}" \
            --notes-file /tmp/release-notes.md \
            --verify-tag

          echo ""
          echo "✅ GitHub release created: https://github.com/${PUBLIC_REPO}/releases/tag/${TAG_NAME}"

      - name: Summary
        run: |
          echo "## Publication Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "✅ Successfully published to [\`${PUBLIC_REPO}\`](https://github.com/${PUBLIC_REPO})" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Target branch:** \`${PUBLIC_BRANCH}\`" >> $GITHUB_STEP_SUMMARY

          if [[ "$GITHUB_REF" == refs/tags/* ]]; then
            TAG_NAME=${GITHUB_REF#refs/tags/}
            echo "**Tag:** \`${TAG_NAME}\`" >> $GITHUB_STEP_SUMMARY

            # If this is a version tag, include release link
            if [[ "$TAG_NAME" == v* ]]; then
              echo "**Release:** [${TAG_NAME}](https://github.com/${PUBLIC_REPO}/releases/tag/${TAG_NAME})" >> $GITHUB_STEP_SUMMARY
            fi
          fi

          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Cleaned items:" >> $GITHUB_STEP_SUMMARY
          echo "- \`.private/\` directory" >> $GITHUB_STEP_SUMMARY
          echo "- \`*.log\` files" >> $GITHUB_STEP_SUMMARY
          echo "- \`*_cache/\` directories" >> $GITHUB_STEP_SUMMARY
          echo "- \`*_files/\` directories" >> $GITHUB_STEP_SUMMARY
          echo "- Workflow files" >> $GITHUB_STEP_SUMMARY
          echo "- AI attributions from commit messages" >> $GITHUB_STEP_SUMMARY