release.yml

name: Release

on:
  push:
    branches:
      - main
  workflow_dispatch:

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: write
  id-token: write
  pull-requests: write

jobs:
  changesets:
    name: Changesets gate
    runs-on: ubuntu-latest
    outputs:
      has_changesets: ${{ steps.changesets.outputs.hasChangesets }}
      should_release: ${{ steps.agenter-release.outputs.should_release }}
      version: ${{ steps.agenter-release.outputs.version }}
      tag: ${{ steps.agenter-release.outputs.tag }}
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Setup Node for npm trusted publishing
        uses: actions/setup-node@v6
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.3.14"

      - name: Install npm with trusted publishing support
        run: npm install -g "npm@^11.10.0"

      - name: Verify release toolchain
        run: |
          node --version
          npm --version
          bun --version

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Create version PR when changesets exist
        id: changesets
        uses: changesets/action@v1
        with:
          version: bun run version-packages
          createGithubReleases: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Resolve release identity and publish gate
        id: agenter-release
        shell: bash
        run: |
          set -euo pipefail
          version="$(node -e "process.stdout.write(JSON.parse(require('fs').readFileSync('packages/agenter/package.json','utf8')).version)")"
          tag="v${version}"
          should_release=false
          if [ "${{ steps.changesets.outputs.hasChangesets }}" = "false" ]; then
            if ! npm view "agenter@${version}" version --json >/dev/null 2>&1; then
              should_release=true
            fi
          fi
          echo "version=${version}" >> "$GITHUB_OUTPUT"
          echo "tag=${tag}" >> "$GITHUB_OUTPUT"
          echo "should_release=${should_release}" >> "$GITHUB_OUTPUT"

  native-artifacts:
    name: Native artifacts (${{ matrix.target }})
    needs: changesets
    if: ${{ needs.changesets.outputs.has_changesets == 'false' && needs.changesets.outputs.should_release == 'true' }}
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: darwin-arm64
            runner: macos-15
          - target: darwin-x64
            runner: macos-15-intel
          - target: linux-arm64
            runner: ubuntu-24.04-arm
          - target: linux-x64
            runner: ubuntu-24.04
          - target: windows-arm64
            runner: windows-11-arm
          - target: windows-x64
            runner: windows-2025
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Build ghostty-native artifact
        shell: bash
        run: |
          set -euo pipefail
          bash packages/ghostty-native/build/build.sh
          mkdir -p native-artifacts
          cp packages/ghostty-native/termless-ghostty-native.node native-artifacts/

      - name: Upload native artifacts
        uses: actions/upload-artifact@v4
        with:
          name: ghostty-native-${{ matrix.target }}
          path: native-artifacts/termless-ghostty-native.node
          if-no-files-found: error

  release:
    name: Publish canonical archives, npm packages, and Homebrew projection
    needs:
      - changesets
      - native-artifacts
    if: ${{ needs.changesets.outputs.has_changesets == 'false' && needs.changesets.outputs.should_release == 'true' }}
    runs-on: ubuntu-latest
    environment: npm-release
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Setup Node for npm trusted publishing
        uses: actions/setup-node@v6
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.3.14"

      - name: Install npm with trusted publishing support
        run: npm install -g "npm@^11.10.0"

      - name: Verify release toolchain
        run: |
          node --version
          npm --version
          bun --version

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Download native artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: ghostty-native-*
          path: native-artifacts

      - name: Stage ghostty-native artifacts into npm packages
        shell: bash
        run: |
          set -euo pipefail
          for target in darwin-arm64 darwin-x64 linux-arm64 linux-x64 windows-arm64 windows-x64; do
            package_os="${target%-*}"
            arch="${target##*-}"
            if [ "$package_os" = "windows" ]; then
              package_os="win32"
            fi

            bun run scripts/binaries/stage-local.ts \
              --source "native-artifacts/ghostty-native-${target}/termless-ghostty-native.node" \
              --package-os "$package_os" \
              --arch "$arch"
          done

      - name: Validate ghostty-native publish package contents
        shell: bash
        run: |
          set -euo pipefail
          for package_dir in \
            packages/ghostty-native \
            packages/ghostty-native-darwin-arm64 \
            packages/ghostty-native-darwin-x64 \
            packages/ghostty-native-linux-arm64-gnu \
            packages/ghostty-native-linux-x64-gnu \
            packages/ghostty-native-win32-arm64-msvc \
            packages/ghostty-native-win32-x64-msvc
          do
            npm pack --dry-run --json "./${package_dir}" >/dev/null
          done

      - name: Release preflight
        run: bun run release:preflight --skip-install

      - name: Prepare release packages from canonical archive truth
        run: bun run release:prepare-packages

      - name: Publish canonical GitHub release archives
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ needs.changesets.outputs.tag }}
          name: agenter ${{ needs.changesets.outputs.tag }}
          target_commitish: ${{ github.sha }}
          files: |
            release-archives/agenter-cli/*.tar.gz
            release-archives/agenter-cli/*.zip
            release-archives/agenter-cli/*.sha256
            release-archives/agenter-cli/agenter-release-archives.json
          fail_on_unmatched_files: true
          overwrite_files: true

      - name: Publish npm packages from prepared release truth
        run: |
          bun run release:publish-bundles
          bun run release:verify-published

      - name: Generate Homebrew projection
        run: |
          bun run homebrew:generate-formula -- \
            --manifest release-archives/agenter-cli/agenter-release-archives.json \
            --output-dir homebrew-projection

      - name: Project Homebrew tap when external repo auth is configured
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          if [ -z "${GH_TOKEN:-}" ]; then
            echo "HOMEBREW_TAP_GITHUB_TOKEN is not configured; skipping Homebrew tap projection."
            exit 0
          fi
          bun run homebrew:bootstrap-tap -- --projection-dir homebrew-projection