publish.yml

name: Publish

on:
  push:
    branches: [main]
    paths:
      - "src/**"
      - "package.json"
      - "pnpm-lock.yaml"
      - ".github/workflows/publish.yml"
  workflow_dispatch:
    inputs:
      bump:
        description: "Release strategy"
        required: true
        default: current
        type: choice
        options:
          - current
          - patch
          - minor
          - major

concurrency:
  group: publish-${{ github.event_name }}
  cancel-in-progress: true

permissions:
  contents: write
  id-token: write

jobs:
  quality:
    name: Quality Gates
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm lint
      - run: pnpm typecheck:ci
      - run: pnpm test:coverage
      - run: pnpm build

  canary:
    name: Publish Canary
    needs: quality
    if: github.event_name == 'push' && vars.CANARY_ENABLED == 'true'
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
          registry-url: https://registry.npmjs.org
      - run: pnpm install --frozen-lockfile
      - run: pnpm build
      - name: Publish canary
        run: |
          sed -i '/_authToken/d' "$NPM_CONFIG_USERCONFIG"
          unset NODE_AUTH_TOKEN

          BASE_VERSION=$(node -p "require('./package.json').version")
          SHORT_SHA=$(echo "$GITHUB_SHA" | cut -c1-7)
          CANARY_VERSION="${BASE_VERSION}-canary.${SHORT_SHA}"
          npm version "$CANARY_VERSION" --no-git-tag-version --ignore-scripts
          # Roll the @canary channel via OIDC (no token). One OIDC publish sets exactly one
          # dist-tag; advancing a 2nd (e.g. @latest) would need a token — the dist-tag PUT
          # returns 401 under OIDC — so @latest is left untouched. Install the newest canary
          # with `npm i <pkg>@canary`.
          npx -y npm@11 publish --tag canary --provenance --access public --ignore-scripts

  release:
    name: Publish Release
    needs: quality
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ github.token }}
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
          registry-url: https://registry.npmjs.org
      - run: pnpm install --frozen-lockfile
      - run: pnpm build

      - name: Prepare version
        id: version
        run: |
          if [ "${{ inputs.bump }}" = "current" ]; then
            VERSION=$(node -p "require('./package.json').version")
          else
            npm version ${{ inputs.bump }} --no-git-tag-version --ignore-scripts
            VERSION=$(node -p "require('./package.json').version")
          fi

          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Generate changelog
        id: changelog
        run: |
          LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
          if [ -z "$LAST_TAG" ]; then
            RANGE="HEAD"
          else
            RANGE="${LAST_TAG}..HEAD"
          fi

          {
            echo "body<<CHANGELOG_EOF"

            FEATS=$(git log "$RANGE" --pretty=format:"%s" --grep="^feat" 2>/dev/null || true)
            if [ -n "$FEATS" ]; then
              echo "### Features"
              echo "$FEATS" | sed 's/^/- /'
              echo ""
            fi

            FIXES=$(git log "$RANGE" --pretty=format:"%s" --grep="^fix" 2>/dev/null || true)
            if [ -n "$FIXES" ]; then
              echo "### Bug Fixes"
              echo "$FIXES" | sed 's/^/- /'
              echo ""
            fi

            OTHERS=$(git log "$RANGE" --pretty=format:"%s" --invert-grep --grep="^feat" --grep="^fix" 2>/dev/null || true)
            if [ -n "$OTHERS" ]; then
              echo "### Other Changes"
              echo "$OTHERS" | sed 's/^/- /'
              echo ""
            fi

            echo "CHANGELOG_EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Commit and tag
        run: |
          VERSION="${{ steps.version.outputs.version }}"

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          if git rev-parse "refs/tags/v$VERSION" >/dev/null 2>&1; then
            echo "Tag v$VERSION already exists"
            exit 1
          fi

          if ! git diff --quiet -- package.json; then
            git add package.json
            git commit -m "chore(release): v$VERSION"
            git push origin main
          fi

          git tag -a "v$VERSION" -m "v$VERSION"
          git push origin "v$VERSION"

      - name: Publish to npm
        run: |
          sed -i '/_authToken/d' "$NPM_CONFIG_USERCONFIG"
          unset NODE_AUTH_TOKEN
          npx -y npm@11 publish --tag latest --provenance --access public --ignore-scripts

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create "v${{ steps.version.outputs.version }}" \
            --title "@vllnt/convex-reactions v${{ steps.version.outputs.version }}" \
            --notes "${{ steps.changelog.outputs.body }}"