release.yml

# workflows/release.yml
#
# Release
# Build, publish, and release rails-paradedb from a validated version.

name: Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Version to release (semver, e.g., 0.1.0). Must match ParadeDB::VERSION."
        type: string
        required: true
      beta:
        description: "Mark this as a prerelease"
        type: boolean
        default: false
      confirmation:
        description: "I confirm version bump, changelog update, and green CI."
        type: boolean
        required: true

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: true

jobs:
  release:
    name: Build and Publish to RubyGems
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Validate confirmation
        if: ${{ github.event.inputs.confirmation != 'true' }}
        run: |
          echo "Please confirm the release checklist first."
          exit 1

      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: .ruby-version
          bundler-cache: true

      - name: Validate version and release state
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail

          VERSION="${{ github.event.inputs.version }}"

          if ! [[ "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
            echo "Invalid version: ${VERSION}"
            exit 1
          fi

          FILE_VERSION="$(ruby -e 'require_relative "lib/parade_db/version"; print ParadeDB::VERSION')"
          if [[ "${VERSION}" != "${FILE_VERSION}" ]]; then
            echo "Version mismatch: workflow input=${VERSION}, file=${FILE_VERSION}"
            exit 1
          fi

          if git ls-remote --tags origin "refs/tags/v${VERSION}" | grep -q "refs/tags/v${VERSION}$"; then
            echo "Tag v${VERSION} already exists."
            exit 1
          fi

          if gh release view "v${VERSION}" > /dev/null 2>&1; then
            echo "GitHub release v${VERSION} already exists."
            exit 1
          fi

          echo "VERSION=${VERSION}" >> "${GITHUB_ENV}"
          echo "Version validation passed for ${VERSION}"

      - name: Build gem
        run: |
          set -euo pipefail
          gem build rails-paradedb.gemspec
          ls -l rails-paradedb-"${VERSION}".gem

      - name: Publish to RubyGems
        env:
          RUBYGEMS_TOKEN: ${{ secrets.RUBYGEMS_TOKEN }}
        run: |
          set -euo pipefail

          if [[ -z "${RUBYGEMS_TOKEN:-}" ]]; then
            echo "Missing RubyGems secret (RUBYGEMS_TOKEN)"
            exit 1
          fi

          mkdir -p "${HOME}/.gem"
          cat > "${HOME}/.gem/credentials" <<EOF
          ---
          :rubygems_api_key: ${RUBYGEMS_TOKEN}
          EOF
          chmod 0600 "${HOME}/.gem/credentials"

          gem push "rails-paradedb-${VERSION}.gem"

      - name: Create GitHub tag and release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: v${{ env.VERSION }}
          target_commitish: ${{ github.sha }}
          prerelease: ${{ github.event.inputs.beta }}
          generate_release_notes: true
          files: rails-paradedb-${{ env.VERSION }}.gem
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Summary
        run: |
          {
            echo "## Released v${VERSION}"
            echo
            echo "- RubyGems: \`rails-paradedb ${VERSION}\` published"
            echo "- GitHub tag: \`v${VERSION}\` created from ${GITHUB_SHA}"
            echo "- GitHub release: created and gem attached"
          } >> "${GITHUB_STEP_SUMMARY}"