release-please.yml

name: Release Please

on:
  push:
    branches:
      - main
  workflow_dispatch: {}

concurrency:
  group: release-please
  cancel-in-progress: false

jobs:
  release-please:
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Generate Short Lived OAuth App Token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: app-token
        with:
          client-id: "${{ secrets.BOT_APP_ID }}"
          private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"
          owner: "${{ github.repository_owner }}"
          repositories: "${{ github.event.repository.name }}"

      - name: Create / Update Release PR
        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5
        id: release
        with:
          token: "${{ steps.app-token.outputs.token }}"

      # Extract the PR branch name into a plain-string step output. Doing this in a gated
      # `run:` block (instead of `fromJson()` inside `env:`/`with:`) avoids the eager
      # template evaluation that fails with "Error reading JToken from JsonReader" when
      # outputs.pr is empty (i.e. when prs_created == 'false').
      - name: Read release PR branch name
        id: pr-meta
        if: ${{ steps.release.outputs.prs_created == 'true' }}
        env:
          PR_JSON: ${{ steps.release.outputs.pr }}
        run: |
          BRANCH=$(printf '%s' "$PR_JSON" | jq -r '.headBranchName // empty')
          if [ -z "$BRANCH" ]; then
            echo "Could not extract headBranchName from release-please pr output"
            exit 1
          fi
          echo "branch=$BRANCH" >> "$GITHUB_OUTPUT"

      - name: Checkout release PR branch
        if: ${{ steps.release.outputs.prs_created == 'true' }}
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ steps.pr-meta.outputs.branch }}
          path: pr-checkout
          persist-credentials: false

      - name: Sync context7.json on release PR
        if: ${{ steps.release.outputs.prs_created == 'true' }}
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          BRANCH: ${{ steps.pr-meta.outputs.branch }}
        working-directory: pr-checkout
        run: |
          NEW_VERSION=$(awk -F= '/^VERSION=/ { gsub(/[^0-9.]/, "", $2); print $2; exit }' Makefile)
          if [ -z "$NEW_VERSION" ]; then
            echo "Could not parse VERSION from Makefile; skipping"
            exit 0
          fi

          # context7.json is NOT in release-please-config.json's extra-files list, so
          # release-please does not touch it. This step is the sole updater: it bumps
          # .previousVersions[0] to the upcoming release tag (read from Makefile, which
          # release-please bumps via release-type: go) so Context7 indexes that version
          # as the latest historical snapshot once the release PR merges.
          if ! jq -e '(.previousVersions // []) | length > 0' context7.json >/dev/null; then
            echo "context7.json has no previousVersions[0] to update; aborting"
            exit 1
          fi

          jq --arg t "v$NEW_VERSION" --arg ver "$NEW_VERSION" \
            '.previousVersions[0].tag = $t | .previousVersions[0].title = $ver' \
            context7.json > context7.json.tmp
          mv context7.json.tmp context7.json

          if git diff --quiet context7.json; then
            echo "context7.json already at v$NEW_VERSION"
            exit 0
          fi

          # Resolve the bot's user id for the DCO Signed-off-by trailer (committer email
          # follows GitHub's <id>+<slug>[bot]@users.noreply.github.com convention).
          APP_SLUG="${{ steps.app-token.outputs.app-slug }}"
          BOT_USER_ID=$(gh api "/users/${APP_SLUG}[bot]" --jq .id)
          if [ -z "$BOT_USER_ID" ]; then
            echo "Could not resolve bot user id for ${APP_SLUG}[bot]"
            exit 1
          fi

          # Commit via the GitHub API so the result is Verified-signed by GitHub and the
          # committer is the app's bot user — no GPG key or git config required. The
          # Signed-off-by trailer preserves DCO compliance in case the DCO check is not
          # configured to auto-exempt [bot] authors.
          COMMIT_MSG=$(printf 'chore(docs): bump context7.json to v%s\n\nSigned-off-by: %s[bot] <%s+%s[bot]@users.noreply.github.com>' \
            "$NEW_VERSION" "$APP_SLUG" "$BOT_USER_ID" "$APP_SLUG")
          CONTENT=$(base64 -w0 context7.json)
          SHA=$(gh api "/repos/${GITHUB_REPOSITORY}/contents/context7.json?ref=${BRANCH}" --jq .sha)
          gh api -X PUT "/repos/${GITHUB_REPOSITORY}/contents/context7.json" \
            -f message="$COMMIT_MSG" \
            -f content="$CONTENT" \
            -f branch="$BRANCH" \
            -f sha="$SHA" >/dev/null

      - name: Checkout
        if: ${{ steps.release.outputs.release_created == 'true' }}
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0

      - name: Add contributors to release
        if: ${{ steps.release.outputs.release_created == 'true' }}
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          TAG="${{ steps.release.outputs.tag_name }}"
          PREV_TAG=$(git describe --tags --abbrev=0 "${TAG}^" 2>/dev/null || echo "")

          if [ -z "$PREV_TAG" ]; then
            echo "No previous tag found, skipping contributors"
            exit 0
          fi

          # Extract PR numbers from squash-merge subjects ("subject (#NN)") only — anchored
          # to end-of-line so issue refs like "fixes #123" inside a subject are ignored.
          PR_NUMBERS=$(git log "${PREV_TAG}..${TAG}" --format='%s' \
            | grep -oE '\(#[0-9]+\)$' | tr -d '(#)' | sort -u)

          # Resolve unique non-bot contributors, sorted alphabetically. Bot detection: GitHub
          # bot logins end in "[bot]"; the "app/" prefix covers the legacy GitHub App identity
          # form some endpoints still emit.
          CONTRIBUTORS=$(for pr in $PR_NUMBERS; do
            gh pr view "$pr" --json author -q '.author.login' 2>/dev/null || true
          done | grep -vE '\[bot\]$|^app/|^$' | sort -u)

          if [ -z "$CONTRIBUTORS" ]; then
            echo "No contributors found"
            exit 0
          fi

          gh release view "$TAG" --json body -q .body > /tmp/body.md

          # Idempotent: skip if a Contributors section is already present (e.g. workflow rerun).
          if grep -q '^### Contributors' /tmp/body.md; then
            echo "Release body already has Contributors section; skipping"
            exit 0
          fi

          LINKS=$(echo "$CONTRIBUTORS" | sed 's/.*/* [@&](https:\/\/github.com\/&)/')
          printf '\n### Contributors\n\n%s\n' "$LINKS" >> /tmp/body.md
          gh release edit "$TAG" --notes-file /tmp/body.md