release.yml

name: Release

on:
  push:
    tags:
      - "v.*.*.*"
  workflow_dispatch:
    inputs:
      version:
        description: "Version tag to release (e.g. v1.2.3)"
        required: true

env:
  MINIMUM_PACKAGE_AGE_HOURS: 0
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
  SAFE_CHAIN_VERSION: "1.4.7"
  SAFE_CHAIN_SHA256: "54c750232d149106ecf4f5f28fee82ba49d2428f1e411e0ed961c0263ae19eaf"

permissions:
  contents: write

jobs:
  release:
    name: Build and release
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Resolve version
        id: version
        env:
          INPUT_VERSION: ${{ github.event.inputs.version }}
          REF_NAME: ${{ github.ref_name }}
          EVENT_NAME: ${{ github.event_name }}
        run: |
          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            VERSION="$INPUT_VERSION"
          else
            VERSION="$REF_NAME"
          fi
          echo "tag=$VERSION" >> "$GITHUB_OUTPUT"
          echo "major=$(echo "$VERSION" | cut -d. -f1)" >> "$GITHUB_OUTPUT"

      - name: Setup Bun
        uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2

      - name: Install safe-chain
        run: |
          curl -fsSL "https://github.com/AikidoSec/safe-chain/releases/download/${SAFE_CHAIN_VERSION}/install-safe-chain.sh" \
            -o install-safe-chain.sh
          echo "${SAFE_CHAIN_SHA256}  install-safe-chain.sh" | sha256sum --check
          sh install-safe-chain.sh --ci

      - name: Install dependencies
        run: bun install
        env:
          SAFE_CHAIN_MINIMUM_PACKAGE_AGE_HOURS: ${{ env.MINIMUM_PACKAGE_AGE_HOURS }}

      - name: Typecheck
        run: bun run typecheck

      - name: Build
        run: bun run build

      - name: Create or update tag
        env:
          TAG: ${{ steps.version.outputs.tag }}
        run: |
          git tag -f "$TAG"
          git push origin "$TAG" --force

      - name: Update floating major tag
        env:
          MAJOR: ${{ steps.version.outputs.major }}
        run: |
          git tag -f "$MAJOR"
          git push origin "$MAJOR" --force

      - name: Build release notes
        id: notes
        env:
          TAG: ${{ steps.version.outputs.tag }}
          MAJOR: ${{ steps.version.outputs.major }}
          REPO: ${{ github.repository }}
        run: |
          SHA=$(git rev-parse HEAD)

          # Parse conventional commits since last tag, grouped by type
          PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || true)
          RANGE="${PREV_TAG:+$PREV_TAG..HEAD}"

          format_section() {
            local prefix="$1" heading="$2"
            local lines
            lines=$(git log $RANGE --pretty=format:"%s|%H" \
              | grep "^${prefix}" \
              | sed "s|^${prefix}[:(][^)]*)[: ]*\(.*\)|\1|;s|^${prefix}: *\(.*\)|\1|" \
              | while IFS='|' read -r msg sha; do
                  short=$(echo "$sha" | cut -c1-7)
                  echo "- $msg ([$short](https://github.com/$REPO/commit/$sha))"
                done)
            if [ -n "$lines" ]; then
              echo "### $heading"
              echo ""
              echo "$lines"
              echo ""
            fi
          }

          {
            echo "## What's changed"
            echo ""
            format_section "feat"     "Features"
            format_section "fix"      "Bug Fixes"
            format_section "security" "Security"
            format_section "perf"     "Performance"
            format_section "refactor" "Refactoring"
            format_section "docs"     "Documentation"
            format_section "chore"    "Chores"
            echo "## Usage"
            echo ""
            echo "Pin to this exact release:"
            echo '```yaml'
            echo "uses: $REPO@$SHA # $TAG"
            echo '```'
            echo ""
            if [ -z "$PREV_TAG" ]; then
              echo "_This is the first release._"
            fi
          } > release_notes.md

      - name: Create GitHub release
        id: release
        uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631 # v2.2.2
        with:
          tag_name: ${{ steps.version.outputs.tag }}
          body_path: release_notes.md

      - name: Job summary
        env:
          TAG: ${{ steps.version.outputs.tag }}
          RELEASE_URL: ${{ steps.release.outputs.url }}
        run: |
          echo "## Release $TAG published" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "**Release URL:** $RELEASE_URL" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          cat release_notes.md >> "$GITHUB_STEP_SUMMARY"