typescript-service-release.yaml

name: TypeScript Service Release

on:
  workflow_call:
    inputs:
      service-name:
        type: string
        required: true
        description: "The name of the service to release"
      bun-version:
        type: string
        required: false
        default: "latest"
        description: "Bun version to use"
      npm-tag:
        type: string
        required: false
        default: "latest"
        description: "NPM tag to publish with"
      no-npm-publish:
        type: boolean
        required: false
        default: false
        description: "Do not publish to npm"
      working-directory:
        type: string
        required: false
        default: "."
        description: "Directory containing package.json"
      build-command:
        type: string
        required: false
        default: "bun run build"
        description: "Build command"
      publish-command:
        type: string
        required: false
        default: "npm publish"
        description: "Command used to publish (e.g., 'npm publish', 'bunx clean-publish'). The --tag, --access, and --dry-run flags are appended automatically."
      labels-to-check:
        type: string
        required: false
        default: '["release", "prerelease"]'
        description: "JSON array of PR labels to check"
      prerelease:
        type: boolean
        required: false
        default: false
        description: "Force prerelease (overrides label)"
      release:
        type: boolean
        required: false
        default: false
        description: "Force release - does both GitHub release and npm publish"
      dry-run:
        type: boolean
        required: false
        default: false
        description: "Run in dry-run mode (no actual publishing)"
      use-blacksmith:
        type: boolean
        required: false
        default: false
        description: "Opt in to Blacksmith Linux runners (blacksmith-4vcpu-ubuntu-2404). Requires the Blacksmith GitHub App installed on the caller org. Defaults to ubuntu-latest."
      use-oidc:
        type: boolean
        required: false
        default: false
        description: "Opt in to npm OIDC Trusted Publishing. When true, the publish job inherits the caller's GITHUB_TOKEN so it can use 'id-token: write' (the caller must grant it) and a trusted publisher must be configured on npmjs.com. Falls back to NPM_TOKEN if OIDC is unavailable. When false (default), publishing uses NPM_TOKEN and the job keeps least-privilege 'contents: read'."
      notify-on-release:
        type: boolean
        required: false
        default: true
        description: "Fire the post-release notify job on real releases (major | minor | patch). Callers not on the in-job allow-list skip cleanly. Set to false to opt a specific release out."
    secrets:
      OPENAI_API_KEY:
        required: true
        description: "OpenAI API key for version and notes"
      NPM_TOKEN:
        required: false
        description: "NPM token (required for npm publish)"
      APP_ID:
        required: false
        description: "GitHub App ID for pushing to protected branches and triggering downstream workflows"
      APP_PRIVATE_KEY:
        required: false
        description: "GitHub App private key for pushing to protected branches and triggering downstream workflows"
      TS_OAUTH_CLIENT_ID:
        required: false
        description: "Tailscale OAuth client ID — used by the notify job to join the tailnet ephemerally"
      TS_OAUTH_SECRET:
        required: false
        description: "Tailscale OAuth client secret matching TS_OAUTH_CLIENT_ID"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  check-labels:
    runs-on: ${{ inputs.use-blacksmith && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
    permissions:
      pull-requests: read
      contents: read
    outputs:
      labels: ${{ steps.check.outputs.labels }}
    steps:
      - name: Check PR Labels
        id: check
        uses: photon-hq/buildspace/.github/blocks/check-pr-label@main
        with:
          labels: ${{ inputs.labels-to-check }}

  release-info:
    needs: check-labels
    if: fromJSON(needs.check-labels.outputs.labels).release || inputs.release
    runs-on: ${{ inputs.use-blacksmith && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
    permissions:
      contents: read
    outputs:
      version: ${{ steps.generate.outputs.version }}
      release_notes: ${{ steps.generate.outputs.release_notes }}
      release_type: ${{ steps.generate.outputs.release_type }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - name: Generate Release Info
        id: generate
        uses: photon-hq/buildspace/.github/blocks/generate-release-info@main
        with:
          service-name: ${{ inputs.service-name }}
          prerelease: ${{ inputs.prerelease || fromJSON(needs.check-labels.outputs.labels).prerelease }}
          openai-api-key: ${{ secrets.OPENAI_API_KEY }}

  bump-version:
    needs: [check-labels, release-info]
    if: fromJSON(needs.check-labels.outputs.labels).release || inputs.release
    runs-on: ${{ inputs.use-blacksmith && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ github.ref }}
          persist-credentials: false

      - name: Bump Version
        uses: photon-hq/buildspace/.github/blocks/bump-npm-version@main
        with:
          version: ${{ needs.release-info.outputs.version }}
          working-directory: ${{ inputs.working-directory }}
          github-token: ${{ github.token }}
          app-id: ${{ secrets.APP_ID }}
          app-private-key: ${{ secrets.APP_PRIVATE_KEY }}

  github-release:
    needs: [check-labels, release-info, bump-version]
    if: fromJSON(needs.check-labels.outputs.labels).release || inputs.release
    runs-on: ${{ inputs.use-blacksmith && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
    permissions:
      contents: write
    steps:
      - name: Create GitHub Release
        uses: photon-hq/buildspace/.github/blocks/create-github-release@main
        with:
          version: ${{ needs.release-info.outputs.version }}
          title: "${{ inputs.service-name }} v${{ needs.release-info.outputs.version }}"
          notes: ${{ needs.release-info.outputs.release_notes }}
          prerelease: ${{ inputs.prerelease || fromJSON(needs.check-labels.outputs.labels).prerelease }}
          app-id: ${{ secrets.APP_ID }}
          app-private-key: ${{ secrets.APP_PRIVATE_KEY }}

  # Default publish path (use-oidc: false). Keeps least-privilege
  # `contents: read` exactly as before and publishes via NPM_TOKEN. Existing
  # callers are unaffected — no permission changes required on their side.
  npm-publish:
    needs: [check-labels, release-info, bump-version]
    if: (fromJSON(needs.check-labels.outputs.labels).release || inputs.release) && inputs.no-npm-publish != true && inputs.use-oidc != true
    runs-on: ${{ inputs.use-blacksmith && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ github.ref_name }}
          fetch-depth: 0
      - name: Publish to NPM
        uses: photon-hq/buildspace/.github/blocks/publish-npm@main
        with:
          bun-version: ${{ inputs.bun-version }}
          tag: ${{ (inputs.prerelease || fromJSON(needs.check-labels.outputs.labels).prerelease) && 'beta' || inputs.npm-tag }}
          working-directory: ${{ inputs.working-directory }}
          build-command: ${{ inputs.build-command }}
          publish-command: ${{ inputs.publish-command }}
          dry-run: ${{ inputs.dry-run }}
          npm-token: ${{ secrets.NPM_TOKEN }}

  # OIDC publish path (use-oidc: true). Opt-in only. It omits an explicit
  # `permissions:` block so it inherits the caller's GITHUB_TOKEN — meaning
  # `id-token: write` flows through when the caller grants it. Because it never
  # *requests* id-token, callers that haven't granted it can't be hard-failed;
  # the publish step just falls back to NPM_TOKEN. Default callers never reach
  # this job (the `if` below is false), so their permissions are untouched.
  npm-publish-oidc:
    needs: [check-labels, release-info, bump-version]
    if: (fromJSON(needs.check-labels.outputs.labels).release || inputs.release) && inputs.no-npm-publish != true && inputs.use-oidc == true
    runs-on: ${{ inputs.use-blacksmith && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
    steps:
      - uses: actions/checkout@v5
        with:
          ref: ${{ github.ref_name }}
          fetch-depth: 0
      - name: Publish to NPM
        uses: photon-hq/buildspace/.github/blocks/publish-npm@main
        with:
          bun-version: ${{ inputs.bun-version }}
          tag: ${{ (inputs.prerelease || fromJSON(needs.check-labels.outputs.labels).prerelease) && 'beta' || inputs.npm-tag }}
          working-directory: ${{ inputs.working-directory }}
          build-command: ${{ inputs.build-command }}
          publish-command: ${{ inputs.publish-command }}
          dry-run: ${{ inputs.dry-run }}
          npm-token: ${{ secrets.NPM_TOKEN }}

  notify:
    needs: [check-labels, release-info, github-release, npm-publish, npm-publish-oidc]
    if: >-
      always() &&
      github.repository == 'photon-hq/spectrum-ts' &&
      (fromJSON(needs.check-labels.outputs.labels).release || inputs.release) &&
      needs.release-info.result == 'success' &&
      needs.github-release.result == 'success' &&
      (needs.npm-publish.result == 'success' || needs.npm-publish.result == 'skipped') &&
      (needs.npm-publish-oidc.result == 'success' || needs.npm-publish-oidc.result == 'skipped') &&
      inputs.notify-on-release &&
      contains(fromJSON('["major","minor","patch"]'), needs.release-info.outputs.release_type)
    runs-on: ${{ inputs.use-blacksmith && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
    permissions:
      contents: read
    steps:
      - name: Join Tailnet
        uses: tailscale/github-action@v3
        with:
          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
          oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
          tags: tag:infra
          version: latest

      - name: POST to email-monkey
        env:
          SERVICE_NAME: ${{ inputs.service-name }}
          REPO: ${{ github.repository }}
          VERSION: ${{ needs.release-info.outputs.version }}
          RELEASE_NOTES: ${{ needs.release-info.outputs.release_notes }}
          RELEASE_TYPE: ${{ needs.release-info.outputs.release_type }}
        shell: bash
        run: |
          set -euo pipefail
          BODY="$(jq -nc \
            --arg repo "$REPO" \
            --arg version "$VERSION" \
            --arg releaseNotes "$RELEASE_NOTES" \
            --arg releaseType "$RELEASE_TYPE" \
            --arg serviceName "$SERVICE_NAME" \
            '{repo:$repo, version:$version, releaseNotes:$releaseNotes, releaseType:$releaseType, serviceName:$serviceName}')"

          echo "POSTing to email-monkey for $REPO (release_type=$RELEASE_TYPE, version=$VERSION)"

          HTTP_CODE="$(curl --silent --show-error \
            --output /tmp/email-monkey.out \
            --write-out '%{http_code}' \
            --max-time 60 \
            --request POST "http://email-monkey/notify-release" \
            --header "Content-Type: application/json" \
            --data "$BODY")"

          echo "email-monkey response ($HTTP_CODE):"
          cat /tmp/email-monkey.out || true
          echo

          if [ "$HTTP_CODE" -ge 400 ]; then
            echo "::error::email-monkey returned HTTP $HTTP_CODE"
            exit 1
          fi