publish-cli.yml

name: Publish CLI

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      dry_run:
        description: Validate the next official beta release without publishing or tagging
        required: false
        type: boolean
        default: false

concurrency:
  group: publish-cli-${{ github.event_name }}
  cancel-in-progress: false

jobs:
  publish-dev:
    name: Publish dev package
    if: ${{ github.event_name == 'push' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write

    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
        with:
          cache: true

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Resolve dev version
        id: cli_version
        run: |
          node scripts/resolve-package-version.mjs dev \
            --package-dir packages/cli \
            --run-number "${GITHUB_RUN_NUMBER}" \
            --run-attempt "${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_OUTPUT"

      - name: Set package version
        working-directory: packages/cli
        run: pnpm version '${{ steps.cli_version.outputs.version }}' --no-git-tag-version

      - name: Publish dev package to npm
        working-directory: packages/cli
        run: npm publish --access public --tag dev --provenance

      - name: Summarize dev publish
        run: |
          VERSION='${{ steps.cli_version.outputs.version }}'
          {
            echo "## Publish CLI Dev"
            echo
            echo "- npm package: \`@prisma/cli@${VERSION}\`"
            echo "- npm dist-tag: \`dev\`"
          } >> "$GITHUB_STEP_SUMMARY"

  publish-official:
    name: Publish official release
    if: ${{ github.event_name == 'workflow_dispatch' }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write

    steps:
      - name: Ensure workflow runs from main
        run: |
          if [ "${GITHUB_REF}" != "refs/heads/main" ]; then
            echo "This workflow only publishes official releases from main."
            exit 1
          fi

      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
        with:
          cache: true

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Resolve next beta version
        id: cli_version
        run: |
          PACKAGE='@prisma/cli'
          LATEST="$(pnpm view "${PACKAGE}" dist-tags.latest --silent 2>/dev/null || true)"
          echo "latest=${LATEST}" >> "$GITHUB_OUTPUT"
          node scripts/resolve-package-version.mjs next-beta \
            --package-dir packages/cli \
            --latest "${LATEST}" >> "$GITHUB_OUTPUT"

      - name: Fail if release tag already exists
        run: |
          VERSION='${{ steps.cli_version.outputs.version }}'
          TAG="cli-v${VERSION}"
          if git ls-remote --exit-code --tags origin "refs/tags/${TAG}" >/dev/null 2>&1; then
            echo "Release tag ${TAG} already exists."
            exit 1
          fi

      - name: Set package version
        working-directory: packages/cli
        run: pnpm version '${{ steps.cli_version.outputs.version }}' --no-git-tag-version

      - name: Validate package artifact
        working-directory: packages/cli
        run: pnpm pack --dry-run

      - name: Ensure release still targets the latest main
        if: ${{ !inputs.dry_run }}
        run: |
          git fetch origin main
          if [ "$(git rev-parse HEAD)" != "$(git rev-parse origin/main)" ]; then
            echo "main moved while the release was running. Rerun the workflow from the latest main."
            exit 1
          fi

      - name: Publish official package to npm
        if: ${{ !inputs.dry_run }}
        working-directory: packages/cli
        run: npm publish --access public --tag latest --provenance

      - name: Create release tag
        if: ${{ !inputs.dry_run }}
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          VERSION='${{ steps.cli_version.outputs.version }}'
          TAG="cli-v${VERSION}"
          SHA="$(git rev-parse HEAD)"
          gh api \
            --method POST \
            "repos/${GITHUB_REPOSITORY}/git/refs" \
            -f ref="refs/tags/${TAG}" \
            -f sha="${SHA}"

      - name: Summarize release
        run: |
          VERSION='${{ steps.cli_version.outputs.version }}'
          LATEST='${{ steps.cli_version.outputs.latest }}'
          {
            echo "## Publish CLI Official"
            echo
            echo "- Previous npm latest: \`${LATEST:-none}\`"
            echo "- Version: \`${VERSION}\`"
            echo "- Dry run: \`${{ inputs.dry_run }}\`"
            if [ '${{ inputs.dry_run }}' = 'true' ]; then
              echo "- Publish: skipped"
              echo "- Tag creation: skipped"
            else
              echo "- npm package: \`@prisma/cli@${VERSION}\`"
              echo "- npm dist-tag: \`latest\`"
              echo "- git tag: \`cli-v${VERSION}\`"
            fi
          } >> "$GITHUB_STEP_SUMMARY"