action.yml

name: 'Changelogs'
description: 'Create a PR with version bumps and changelogs, and publish packages when merged'
author: 'wevm'

branding:
  icon: 'package'
  color: 'orange'

inputs:
  ecosystem:
    description: 'Ecosystem to use (rust, python, go). Auto-detected if not specified.'
    required: false
  crate-token:
    description: 'Crates.io API token for publishing (Rust)'
    required: false
  pypi-token:
    description: 'PyPI API token for publishing (Python)'
    required: false
  python-version:
    description: 'Python version for building and publishing (Python ecosystem)'
    required: false
    default: '3.11'
  commit:
    description: 'Commit message for version bump (overrides conventional-commit)'
    required: false
  conventional-commit:
    description: 'Use conventional commit format (chore: prefix)'
    required: false
    default: 'false'
  prerelease:
    description: 'Prerelease identifier for release candidates (e.g. rc creates rc1, rc2).'
    required: false
  branch:
    description: 'Branch name for the version PR. Defaults to changelog-release/{trigger-branch}, enabling independent release PRs per branch.'
    required: false
  post-version-command:
    description: 'Command to run after version bumps but before PR creation (e.g. refreshing lockfiles).'
    required: false
  publish-mode:
    description: '"registry" (default) publishes to crates.io/PyPI when registry authentication is configured. "tags-only" intentionally skips registry authentication and only creates git tags + GitHub releases. When no registry authentication is configured, registry upload is skipped automatically.'
    required: false
    default: 'registry'
  github-token:
    description: 'GitHub token for creating PRs'
    required: false
    default: ${{ github.token }}

outputs:
  hasChangelogs:
    description: 'Whether there are pending changelogs'
    value: ${{ steps.check.outputs.hasChangelogs }}
  pullRequestNumber:
    description: 'The pull request number if created or updated'
    value: ${{ steps.pr.outputs.pull-request-number }}
  published:
    description: 'Whether packages were published'
    value: ${{ steps.publish.outputs.published }}
  publishedPackages:
    description: 'JSON array of published packages'
    value: ${{ steps.publish.outputs.publishedPackages }}

runs:
  using: 'composite'
  steps:
    - name: Validate publish mode
      shell: bash
      env:
        PUBLISH_MODE: ${{ inputs.publish-mode }}
      run: |
        case "$PUBLISH_MODE" in
          registry|tags-only) ;;
          *)
            echo "::error::Invalid publish-mode '$PUBLISH_MODE'. Expected 'registry' or 'tags-only'."
            exit 1
            ;;
        esac

    # Python tooling is only needed when the caller explicitly selects the
    # Python ecosystem. Other ecosystems can use GitHub OIDC for their own
    # registries, so OIDC availability alone must not trigger PyPI setup.
    - name: Setup Python (for Python ecosystem)
      if: inputs.ecosystem == 'python'
      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
      with:
        python-version: ${{ inputs.python-version }}

    - name: Install Python build tools (for Python ecosystem)
      if: inputs.ecosystem == 'python'
      shell: bash
      run: pip install build==1.2.2.post1 twine==6.2.0

    - name: Cache changelogs binary
      id: cache
      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: ~/.cargo/bin/changelogs
        key: changelogs-${{ runner.os }}-${{ runner.arch }}-${{ github.action_ref || hashFiles('Cargo.toml') }}

    - name: Install changelogs
      if: steps.cache.outputs.cache-hit != 'true'
      shell: bash
      run: cargo install --path "${{ github.action_path }}"

    - name: Check for changelogs
      id: check
      shell: bash
      env:
        ECOSYSTEM_INPUT: ${{ inputs.ecosystem }}
        PRERELEASE_INPUT: ${{ inputs.prerelease }}
      run: |
        has_changelogs=false
        if [ -d ".changelog" ] && [ "$(find .changelog -name '*.md' ! -name 'README.md' 2>/dev/null | head -1)" ]; then
          has_changelogs=true
          echo "Found pending changelogs"
        else
          echo "No pending changelogs"
        fi
        echo "hasChangelogs=$has_changelogs" >> $GITHUB_OUTPUT

        has_prereleases=false
        if [ "$has_changelogs" = "false" ] && [ -z "$PRERELEASE_INPUT" ]; then
          CMD=(changelogs)
          if [ -n "$ECOSYSTEM_INPUT" ]; then
            CMD+=(--ecosystem "$ECOSYSTEM_INPUT")
          fi
          CMD+=(version --dry-run)

          output=$("${CMD[@]}" 2>&1) && version_exit=0 || version_exit=$?
          if [ $version_exit -eq 0 ] && echo "$output" | grep -Eq '[0-9]+\.[0-9]+\.[0-9]+-[0-9A-Za-z][0-9A-Za-z.-]*(\+[0-9A-Za-z][0-9A-Za-z.-]*)? → [0-9]+\.[0-9]+\.[0-9]+'; then
            has_prereleases=true
            echo "Found prerelease versions to promote"
          fi
        fi
        echo "hasPrereleases=$has_prereleases" >> $GITHUB_OUTPUT

    - name: Resolve release branch
      id: resolve-branch
      shell: bash
      env:
        RELEASE_BRANCH_INPUT: ${{ inputs.branch }}
        REF_NAME: ${{ github.ref_name }}
      run: |
        release_branch="$RELEASE_BRANCH_INPUT"
        if [ -z "$release_branch" ]; then
          ref="${REF_NAME#refs/heads/}"
          release_branch="changelog-release/${ref}"
        fi
        echo "release_branch=$release_branch" >> "$GITHUB_OUTPUT"

    # Version mode: Create PR when changelogs exist, or when prereleases can be promoted to stable.
    - name: Setup Git user
      if: steps.check.outputs.hasChangelogs == 'true' || steps.check.outputs.hasPrereleases == 'true'
      shell: bash
      run: |
        git config user.name "github-actions[bot]"
        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

    - name: Run version command
      if: steps.check.outputs.hasChangelogs == 'true' || steps.check.outputs.hasPrereleases == 'true'
      id: version
      shell: bash
      env:
        ECOSYSTEM_INPUT: ${{ inputs.ecosystem }}
        PRERELEASE_INPUT: ${{ inputs.prerelease }}
      run: |
        export PATH="$HOME/.local/bin:$PATH"
        CMD=(changelogs)
        if [ -n "$ECOSYSTEM_INPUT" ]; then
          CMD+=(--ecosystem "$ECOSYSTEM_INPUT")
        fi
        CMD+=(version)
        if [ -n "$PRERELEASE_INPUT" ]; then
          CMD+=(--prerelease "$PRERELEASE_INPUT")
        fi
        output=$("${CMD[@]}" 2>&1) && version_exit=0 || version_exit=$?
        echo "$output"
        if [ $version_exit -ne 0 ]; then
          echo "::error::changelogs version failed with exit code $version_exit"
          exit $version_exit
        fi
        
        # Check if using root changelog format (unified versioning)
        changelog_format="per-crate"
        if [ -f ".changelog/config.toml" ]; then
          fmt=$(grep -E '^\s*format\s*=' .changelog/config.toml | sed 's/.*=\s*"\(.*\)"/\1/' | tr -d '[:space:]')
          if [ "$fmt" = "root" ]; then
            changelog_format="root"
          fi
        fi
        
        # Extract versions from output (e.g., "tempo-common 0.1.4 → 0.1.5-rc1" -> "tempo-common@0.1.5-rc1")
        semver_re='[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z][0-9A-Za-z.-]*)?(\+[0-9A-Za-z][0-9A-Za-z.-]*)?'
        all_versions=$(echo "$output" | grep -oE "[^[:space:]]+ $semver_re → $semver_re" | sed 's/ .* → /@/')
        count=$(echo "$all_versions" | grep -c . || true)
        
        if [ "$changelog_format" = "root" ]; then
          # Root format: all packages share one version, use v{version}
          new_version=$(echo "$all_versions" | head -1 | sed 's/.*@//')
          if [ -n "$new_version" ]; then
            versions="\`v$new_version\`"
          else
            versions=""
          fi
        elif [ "$count" -eq 0 ]; then
          versions=""
        elif [ "$count" -eq 1 ]; then
          versions="\`$(echo "$all_versions" | head -1)\`"
        elif [ "$count" -eq 2 ]; then
          first=$(echo "$all_versions" | head -1)
          second=$(echo "$all_versions" | tail -1)
          versions="\`$first\` and \`$second\`"
        else
          first=$(echo "$all_versions" | head -1)
          second=$(echo "$all_versions" | sed -n '2p')
          remaining=$((count - 2))
          versions="\`$first\`, \`$second\` and $remaining more"
        fi
        echo "versions=$versions" >> $GITHUB_OUTPUT
        
        # Build title and commit message with optional conventional commit prefix
        if [ "${{ inputs.conventional-commit }}" = "true" ]; then
          echo "title=chore: release $versions" >> $GITHUB_OUTPUT
          echo "commit-msg=chore: release $versions" >> $GITHUB_OUTPUT
        else
          echo "title=Release $versions" >> $GITHUB_OUTPUT
          echo "commit-msg=Release $versions" >> $GITHUB_OUTPUT
        fi

    - name: Run post-version command
      if: (steps.check.outputs.hasChangelogs == 'true' || steps.check.outputs.hasPrereleases == 'true') && inputs.post-version-command != ''
      shell: bash
      run: ${{ inputs.post-version-command }}

    - name: Generate PR body
      if: steps.check.outputs.hasChangelogs == 'true' || steps.check.outputs.hasPrereleases == 'true'
      id: body
      shell: bash
      run: |
        {
          echo "This PR was opened by the Changelogs release workflow."
          echo ""
          echo "When you're ready to release, merge this PR and the packages will be published."
          echo ""
          echo "---"
          echo ""
          
          # Show the new changelog entries (uncommitted changes from changelogs version)
          if [ -f "CHANGELOG.md" ]; then
            git diff -- CHANGELOG.md | grep '^+' | grep -v '^+++' | sed 's/^+//' | head -100 || true
          fi
        } > /tmp/pr-body.md
        
        echo "body-file=/tmp/pr-body.md" >> $GITHUB_OUTPUT

    - name: Create or update PR
      if: steps.check.outputs.hasChangelogs == 'true' || steps.check.outputs.hasPrereleases == 'true'
      id: pr
      uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
      with:
        token: ${{ inputs.github-token }}
        branch: ${{ steps.resolve-branch.outputs.release_branch }}
        title: ${{ steps.version.outputs.title }}
        body-path: ${{ steps.body.outputs.body-file }}
        base: ${{ github.ref_name }}
        commit-message: ${{ inputs.commit || steps.version.outputs.commit-msg }}
        delete-branch: true

    # Publish mode: Publish when no changelogs or stable-promotion PR are needed.
    # Will publish to registry if tokens provided, otherwise just creates git tags
    - name: Setup Git user for tags
      if: steps.check.outputs.hasChangelogs == 'false' && steps.check.outputs.hasPrereleases == 'false'
      shell: bash
      run: |
        git config user.name "github-actions[bot]"
        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

    # Configure PyPI authentication for the publish step that follows.
    # Two modes:
    #   1. Static API token: `pypi-token` input is set -> use it directly.
    #   2. OIDC trusted publishing: `pypi-token` is empty AND the workflow
    #      has `permissions: id-token: write` -> mint a short-lived PyPI
    #      API token by exchanging the GitHub OIDC ID token at PyPI's
    #      `_/oidc/mint-token` endpoint. Requires a configured Trusted
    #      Publisher on the PyPI project that matches the workflow.
    # Run only for explicit Python publish workflows. Non-Python workflows can
    # also have GitHub OIDC enabled for their own registries, and must not try
    # to exchange that OIDC token with PyPI.
    - name: Configure PyPI auth
      if: steps.check.outputs.hasChangelogs == 'false' && steps.check.outputs.hasPrereleases == 'false' && inputs.ecosystem == 'python' && inputs.publish-mode != 'tags-only'
      shell: bash
      env:
        PYPI_TOKEN_INPUT: ${{ inputs.pypi-token }}
      run: |
        if [ -n "$PYPI_TOKEN_INPUT" ]; then
          echo "::add-mask::$PYPI_TOKEN_INPUT"
          echo "TWINE_PASSWORD=$PYPI_TOKEN_INPUT" >> "$GITHUB_ENV"
          echo "Using static PyPI API token from pypi-token input"
        elif [ -n "$ACTIONS_ID_TOKEN_REQUEST_TOKEN" ]; then
          echo "Minting PyPI API token via OIDC trusted publishing..."
          oidc_resp=$(curl -sSL --fail \
            -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
            "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=pypi")
          oidc_token=$(echo "$oidc_resp" | jq -r .value)
          if [ -z "$oidc_token" ] || [ "$oidc_token" = "null" ]; then
            echo "::error::Failed to obtain GitHub OIDC ID token for PyPI trusted publishing"
            exit 1
          fi
          mint_resp=$(curl -sSL -X POST \
            -H "Content-Type: application/json" \
            -d "{\"token\":\"$oidc_token\"}" \
            https://pypi.org/_/oidc/mint-token)
          api_token=$(echo "$mint_resp" | jq -r .token)
          if [ -z "$api_token" ] || [ "$api_token" = "null" ]; then
            echo "::error::PyPI rejected OIDC token. Check that a Trusted Publisher is configured for this project, repo, workflow filename, and environment."
            echo "Response: $mint_resp"
            exit 1
          fi
          echo "::add-mask::$api_token"
          echo "TWINE_PASSWORD=$api_token" >> "$GITHUB_ENV"
          echo "Minted short-lived PyPI API token via OIDC"
        else
          echo "No pypi-token input and no OIDC available (workflow needs 'permissions: id-token: write'). Publish will skip with 'no token'."
        fi

    - name: Publish packages
      if: steps.check.outputs.hasChangelogs == 'false' && steps.check.outputs.hasPrereleases == 'false'
      id: publish
      shell: bash
      env:
        CARGO_REGISTRY_TOKEN: ${{ inputs.publish-mode != 'tags-only' && inputs.crate-token || '' }}
        PUBLISH_MODE: ${{ inputs.publish-mode }}
        TWINE_USERNAME: __token__
        # TWINE_PASSWORD is set via $GITHUB_ENV by the "Configure PyPI auth" step
        # (either from inputs.pypi-token or minted via OIDC trusted publishing).
      run: |
        export PATH="$HOME/.local/bin:$PATH"
        if [ "$PUBLISH_MODE" = "tags-only" ]; then
          unset CARGO_REGISTRY_TOKEN
          unset TWINE_USERNAME
          unset TWINE_PASSWORD
        fi
        ECOSYSTEM_FLAG=""
        if [ -n "${{ inputs.ecosystem }}" ]; then
          ECOSYSTEM_FLAG="--ecosystem ${{ inputs.ecosystem }}"
        fi
        output=$(changelogs $ECOSYSTEM_FLAG publish 2>&1) && publish_exit=0 || publish_exit=$?
        echo "$output"
        
        # Parse published packages from output (✓ = published, ⊘ = skipped/tags-only)
        packages=$(echo "$output" | { grep -E "^\s+\S+\s+v[0-9]" || true; } | { grep -E "✓|⊘" || true; } | awk '{print $1}' | jq -R -s -c 'split("\n") | map(select(length > 0))')
        
        if [ "$packages" != "[]" ] && [ -n "$packages" ]; then
          echo "published=true" >> $GITHUB_OUTPUT
          echo "publishedPackages=$packages" >> $GITHUB_OUTPUT
        else
          echo "published=false" >> $GITHUB_OUTPUT
          echo "publishedPackages=[]" >> $GITHUB_OUTPUT
        fi

        if [ $publish_exit -ne 0 ]; then
          echo "::error::changelogs publish failed with exit code $publish_exit"
          exit $publish_exit
        fi

    - name: Push git tags
      if: steps.check.outputs.hasChangelogs == 'false' && steps.check.outputs.hasPrereleases == 'false' && steps.publish.outcome == 'success'
      shell: bash
      run: git push --follow-tags

    - name: Create GitHub releases
      if: steps.check.outputs.hasChangelogs == 'false' && steps.check.outputs.hasPrereleases == 'false' && steps.publish.outcome == 'success'
      shell: bash
      env:
        GH_TOKEN: ${{ inputs.github-token }}
      run: |
        # Get tags that were just pushed
        for tag in $(git tag --points-at HEAD); do
          echo "Creating release for $tag"
          
          # Extract changelog section for this tag
          changelog_notes=""
          
          # Parse package name from tag (e.g., "tidx@0.1.1" -> "tidx")
          if [[ "$tag" == *"@"* ]]; then
            pkg_name="${tag%@*}"
          else
            pkg_name=""
          fi
          
          # Find the changelog file (per-crate or root)
          changelog_file=""
          if [ -n "$pkg_name" ]; then
            # Check common locations for per-crate changelogs
            for dir in "crates/$pkg_name" "packages/$pkg_name" "$pkg_name"; do
              if [ -f "$dir/CHANGELOG.md" ]; then
                changelog_file="$dir/CHANGELOG.md"
                break
              fi
            done
            # Fallback: try stripping first prefix (e.g., "tempo-alloy" -> "alloy")
            if [ -z "$changelog_file" ]; then
              stripped="${pkg_name#*-}"
              if [ "$stripped" != "$pkg_name" ]; then
                for dir in "crates/$stripped" "packages/$stripped" "$stripped"; do
                  if [ -f "$dir/CHANGELOG.md" ]; then
                    changelog_file="$dir/CHANGELOG.md"
                    break
                  fi
                done
              fi
            fi
          fi
          # Fall back to root CHANGELOG.md
          if [ -z "$changelog_file" ] && [ -f "CHANGELOG.md" ]; then
            changelog_file="CHANGELOG.md"
          fi
          
          if [ -n "$changelog_file" ]; then
            # Extract version from tag: "pkg@1.2.3" -> "1.2.3", "v1.2.3" -> "1.2.3"
            if [[ "$tag" == v* ]]; then
              version="${tag#v}"
            elif [[ "$tag" == *"@"* ]]; then
              version="${tag#*@}"
            else
              version="$tag"
            fi
            
            changelog_notes=$(awk -v ver="$version" -v tag="$tag" '
              BEGIN {
                printing=0
                root_prefix="## " ver
                tag_prefix="## `" tag "`"
              }
              /^## / {
                if (printing) exit
                if (index($0, tag_prefix) == 1) { printing=1; next }
                if (index($0, root_prefix) == 1) {
                  c = substr($0, length(root_prefix) + 1, 1)
                  if (c == " " || c == "(" || c == "") { printing=1; next }
                }
              }
              printing { print }
            ' "$changelog_file")
          fi
          
          # Find previous tag with the same package prefix for accurate changelog diff.
          # NOTE: `grep -Fxv` exits 1 when every input line matches the excluded
          # pattern (i.e. when the only tag is `$tag` itself), and under
          # `set -e -o pipefail` that aborts the whole "Create GitHub releases"
          # step before any release is created. The `|| true` after each grep
          # pipeline degrades that case to "no previous tag" instead of failing.
          previous_tag=""
          if [[ "$tag" == *"@"* ]]; then
            prefix="${tag%@*}@"
            # Pick the next-lower version after current tag, with grep fallback
            previous_tag=$(git tag --list "${prefix}*" --sort=-version:refname | awk -v cur="$tag" '$0==cur{found=1;next} found{print;exit}')
            if [ -z "$previous_tag" ]; then
              previous_tag=$(git tag --list "${prefix}*" --sort=-version:refname | { grep -Fxv -- "$tag" || true; } | head -1)
            fi
          else
            previous_tag=$(git tag --list "v*" --sort=-version:refname | awk -v cur="$tag" '$0==cur{found=1;next} found{print;exit}')
            if [ -z "$previous_tag" ]; then
              previous_tag=$(git tag --list "v*" --sort=-version:refname | { grep -Fxv -- "$tag" || true; } | head -1)
            fi
          fi
          
          # Generate GitHub's notes to get "New Contributors" and "Full Changelog"
          generate_notes_args=(-f tag_name="$tag")
          if [ -n "$previous_tag" ]; then
            generate_notes_args+=(-f previous_tag_name="$previous_tag")
          fi
          github_notes=$(gh api repos/${{ github.repository }}/releases/generate-notes \
            "${generate_notes_args[@]}" \
            --jq '.body' 2>/dev/null || echo "")
          
          # Extract "What's Changed" body so we can re-include it for contributor attribution.
          # GitHub generates release page avatars from "by @username in #NNN" entries,
          # which only appear in the "What's Changed" section.
          whats_changed=$(echo "$github_notes" | awk '
            /^## What'\''s Changed/ { in_section=1; next }
            /^## New Contributors/ { in_section=0 }
            /^\*\*Full Changelog\*\*/ { in_section=0 }
            in_section { print }
          ')

          # Remove "What's Changed" section, keep "New Contributors" and "Full Changelog"
          github_extras=$(echo "$github_notes" | awk '
            BEGIN { skip=0 }
            /^## What'\''s Changed/ { skip=1; next }
            /^## New Contributors/ { skip=0 }
            /^\*\*Full Changelog\*\*/ { skip=0 }
            !skip { print }
          ')

          # For first-ever per-crate release, skip GitHub extras (no meaningful diff)
          if [[ "$tag" == *"@"* ]] && [ -z "$previous_tag" ]; then
            github_extras=""
          fi

          # Re-include "What's Changed" as a collapsed section so GitHub can attribute
          # all PR authors as release contributors, not just first-time contributors.
          if [ -n "$whats_changed" ]; then
            collapsed="<details><summary>What's Changed</summary>"$'\n\n'"$whats_changed"$'\n'"</details>"
            github_extras="$collapsed"$'\n\n'"$github_extras"
          fi

          # Combine: changelog content + GitHub extras (New Contributors, Full Changelog)
          if [ -n "$changelog_notes" ]; then
            notes="$changelog_notes"
            if [ -n "$github_extras" ]; then
              notes="$notes"$'\n\n'"$github_extras"
            fi
            echo "$notes" | gh release create "$tag" --notes-file - || true
          elif [ -n "$github_notes" ]; then
            echo "$github_notes" | gh release create "$tag" --notes-file - || true
          else
            gh release create "$tag" --notes "" || true
          fi
        done