release.yml

name: Release

on:
  push:
    branches:
      - main
    paths:
      - '.changeset/**'
      - '**/package.json'
      - 'typescript/**'
      - '!typescript/infra/**'
      - '!typescript/ccip-server/**'
      - '!typescript/github-proxy/**'
      - '!typescript/http-registry-server/**'
      - '!typescript/tsconfig/**'
      - 'solidity/**'
      - 'starknet/**'
      - 'pnpm-lock.yaml'
      - '.github/workflows/release.yml'
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:
    inputs:
      snapshot_tag:
        description: 'NPM dist-tag for the beta release'
        required: true
        default: 'beta'
        type: choice
        options:
          - beta
          - alpha
          - rc
          - preview
      include_zksync:
        description: 'Include ZKSync build artifacts (adds ~6min)'
        required: false
        default: false
        type: boolean

concurrency: ${{ github.workflow }}-${{ github.ref }}

env:
  LOG_FORMAT: PRETTY
  TURBO_TELEMETRY_DISABLED: 1
  TURBO_API: https://cache.depot.dev
  TURBO_TOKEN: ${{ secrets.DEPOT_TURBO_TOKEN }}
  TURBO_TEAM: ${{ secrets.DEPOT_ORG_ID }}

jobs:
  # This job prepares the release by creating or updating a release PR.
  # Notice the omission of the `publish` flag in the changesets action.
  prepare-release:
    if: github.event_name == 'push'
    permissions:
      id-token: write
      contents: write
      pull-requests: write
    runs-on: depot-ubuntu-24.04
    steps:
      # Generate GitHub App token first.
      # Used by checkout fetch + changesets/action (via GITHUB_TOKEN) for release PR auth.
      - name: Generate GitHub App Token
        id: generate-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.HYPER_GONK_APP_ID }}
          private-key: ${{ secrets.HYPER_GONK_PRIVATE_KEY }}

      - name: Checkout Repo
        uses: actions/checkout@v6
        with:
          # check out full history
          fetch-depth: 0
          submodules: recursive
          persist-credentials: false
          token: ${{ steps.generate-token.outputs.token }}

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: .nvmrc

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Install Dependencies
        run: pnpm install --frozen-lockfile

      - name: Get GitHub App User ID
        id: get-user-id
        run: echo "user-id=$(gh api /users/${{ steps.generate-token.outputs.app-slug }}[bot] --jq .id)" >> "$GITHUB_OUTPUT"
        env:
          GH_TOKEN: ${{ steps.generate-token.outputs.token }}

      - name: Configure Git for Hyper Gonk
        run: |
          git config user.name "${{ steps.generate-token.outputs.app-slug }}[bot]"
          git config user.email "${{ steps.get-user-id.outputs.user-id }}+${{ steps.generate-token.outputs.app-slug }}[bot]@users.noreply.github.com"

      - name: Create Release PR
        id: changesets
        uses: changesets/action@v1
        with:
          title: 'chore: release npm packages'
          version: pnpm version:prepare
          setupGitUser: false
        env:
          NPM_CONFIG_PROVENANCE: true
          GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}

  check-latest-published:
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    outputs:
      all_latest: ${{ steps.check.outputs.all_latest }}
    steps:
      - uses: actions/checkout@v6

      - name: Retrieve package versions
        id: pkg
        run: |
          find . -name 'package.json' -print0 | while IFS= read -r -d '' pkg; do
            jq -r 'select(.private != true) | .name + "@" + .version' "$pkg"
          done | tee versions.txt

      - name: Compare package versions
        id: check
        run: |
          all_latest=true
          while read -r pkg; do
            echo "Checking if $pkg is published..."
            exists=$(npm view "$pkg" version 2>/dev/null || echo "N/A")
            echo "npm returned: $exists"
            if [ "$exists" = "N/A" ]; then
              echo "$pkg is NOT published."
              all_latest=false
              break
            else
              echo "$pkg is published."
            fi
          done < versions.txt
          echo "all_latest=$all_latest" >> $GITHUB_OUTPUT

  # If we detect that not all packages are published, we run the
  # cli-install-test workflow to verify that the CLI installs correctly.
  # Windows is excluded here for speed but tested nightly via cli-install-test.yml.
  cli-install-cross-platform-release-test:
    needs: [check-latest-published]
    if: github.event_name == 'push' && needs.check-latest-published.outputs.all_latest == 'false'
    uses: ./.github/workflows/cli-install-test.yml
    with:
      include-windows: false

  # This job publishes the release to NPM.
  publish-release:
    needs: cli-install-cross-platform-release-test
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    permissions:
      id-token: write
      contents: write
      pull-requests: write
    runs-on: ubuntu-latest
    steps:
      # Generate GitHub App token first.
      # Used by checkout fetch + changesets/action (via GITHUB_TOKEN) for publish auth.
      - name: Generate GitHub App Token
        id: generate-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.HYPER_GONK_APP_ID }}
          private-key: ${{ secrets.HYPER_GONK_PRIVATE_KEY }}

      - name: Checkout Repo
        uses: actions/checkout@v6
        with:
          # check out full history
          fetch-depth: 0
          submodules: recursive
          persist-credentials: false
          token: ${{ steps.generate-token.outputs.token }}

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version-file: .nvmrc
          registry-url: 'https://registry.npmjs.org'

      - name: Setup Foundry
        uses: ./.github/actions/setup-foundry

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Install Dependencies
        run: pnpm install --frozen-lockfile

      - name: Get GitHub App User ID
        id: get-user-id
        run: echo "user-id=$(gh api /users/${{ steps.generate-token.outputs.app-slug }}[bot] --jq .id)" >> "$GITHUB_OUTPUT"
        env:
          GH_TOKEN: ${{ steps.generate-token.outputs.token }}

      - name: Configure Git for Hyper Gonk
        run: |
          git config user.name "${{ steps.generate-token.outputs.app-slug }}[bot]"
          git config user.email "${{ steps.get-user-id.outputs.user-id }}+${{ steps.generate-token.outputs.app-slug }}[bot]@users.noreply.github.com"

      - name: Publish Release to NPM
        id: changesets
        uses: changesets/action@v1
        with:
          title: 'chore: release npm packages'
          version: pnpm version:prepare
          publish: pnpm release
          setupGitUser: false
        env:
          NPM_CONFIG_PROVENANCE: true
          GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}

  publish-beta:
    if: github.event_name == 'workflow_dispatch'
    concurrency:
      group: npm-beta-release
      cancel-in-progress: false
    permissions:
      contents: read
      id-token: write
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          submodules: recursive
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: .nvmrc
          registry-url: 'https://registry.npmjs.org'

      - name: Check for changesets
        run: |
          CHANGESET_COUNT=$(find .changeset -name "*.md" ! -name "README.md" ! -name "config.json" 2>/dev/null | wc -l | tr -d ' ')
          if [ "$CHANGESET_COUNT" -eq 0 ]; then
            echo "::error::No pending changesets found. Beta releases require pending changeset files."
            echo ""
            echo "To create a beta release:"
            echo "1. Add a changeset: pnpm exec changeset"
            echo "2. Commit the changeset file"
            echo "3. Run this workflow again"
            exit 1
          fi
          echo "Found $CHANGESET_COUNT changeset(s)"

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # Need to install foundry for the build step. `hardhat-foundry` expects foundry to be installed.
      - name: Setup Foundry
        uses: ./.github/actions/setup-foundry

      # Build BEFORE snapshot versioning so turbo cache hits are preserved.
      # Snapshot versioning rewrites every package.json, which invalidates turbo hashes.
      - name: Build packages
        run: pnpm run build

      - name: Inspect SDK dist after build
        run: |
          echo "Source cross-collateral predicate:"
          rg -n "isCrossCollateralToken|SealevelHypCrossCollateral" typescript/sdk/src/token/Token.ts
          echo ""
          echo "Dist token entry:"
          sed -n '1,12p' typescript/sdk/dist/token/Token.js || true
          echo ""
          echo "Dist TokenMetadata predicate:"
          sed -n '70,90p' typescript/sdk/dist/token/TokenMetadata.js || true
          echo ""
          if [ -f typescript/sdk/dist/token/TokenMetadata.js ] && \
             rg -q "SealevelHypCrossCollateral" typescript/sdk/src/token/Token.ts && \
             ! rg -q "SealevelHypCrossCollateral" typescript/sdk/dist/token/TokenMetadata.js; then
            echo "::error::SDK dist is stale on CI: source includes SealevelHypCrossCollateral but dist/token/TokenMetadata.js does not"
            exit 1
          fi
          echo "No sdk dist/source mismatch detected"

      - name: Build ZKSync artifacts
        if: inputs.include_zksync
        run: pnpm run build:zk

      - name: Create snapshot versions
        run: pnpm exec changeset version --snapshot ${{ inputs.snapshot_tag }}

      - name: Get snapshot version
        id: version
        run: |
          SNAPSHOT_VERSION=$(node -p "require('./typescript/sdk/package.json').version")
          echo "snapshot=$SNAPSHOT_VERSION" >> $GITHUB_OUTPUT

      - name: Publish beta packages
        run: pnpm exec changeset publish --tag ${{ inputs.snapshot_tag }} --no-git-tag
        env:
          NPM_CONFIG_PROVENANCE: true

      - name: Summary
        run: |
          echo "### Beta Release Published" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Version:** \`${{ steps.version.outputs.snapshot }}\`" >> $GITHUB_STEP_SUMMARY
          echo "**NPM Tag:** \`${{ inputs.snapshot_tag }}\`" >> $GITHUB_STEP_SUMMARY
          echo "**Branch:** \`${{ github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "Install with:" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`bash" >> $GITHUB_STEP_SUMMARY
          echo "npm install @hyperlane-xyz/sdk@${{ inputs.snapshot_tag }}" >> $GITHUB_STEP_SUMMARY
          echo "npm install @hyperlane-xyz/cli@${{ inputs.snapshot_tag }}" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY

  notify-publish-failure:
    if: >-
      always() && (
        needs.publish-release.result == 'failure' ||
        needs.check-latest-published.result == 'failure' ||
        needs.cli-install-cross-platform-release-test.result == 'failure'
      )
    needs:
      [
        check-latest-published,
        cli-install-cross-platform-release-test,
        publish-release,
      ]
    runs-on: ubuntu-latest
    steps:
      - name: Notify Slack on publish failure
        uses: slackapi/slack-github-action@v3
        with:
          webhook: ${{ secrets.SLACK_INCIDENTS_WEBHOOK }}
          webhook-type: incoming-webhook
          payload: |
            text: ":alert: NPM package publish failed — see workflow run for details"
            blocks:
              - type: "section"
                text:
                  type: "mrkdwn"
                  text: ":alert: *NPM package publish failed*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View workflow run #${{ github.run_number }}>"