release.yml

name: Build & Publish Release

on:
  release:
    types:
      - released
      - prereleased

concurrency:
  group: "release-${{ github.event.release.id }}"
  cancel-in-progress: true

permissions:
  id-token: write

jobs:
  sanity-checks:
    name: Sanity Checks
    permissions:
      id-token: none
    uses: ./.github/workflows/sanity-checks.yml

  add-publishing-note:
    name: Add Publishing Note
    if: github.event.release != null
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: none
    concurrency:
      group: "release-editing-${{ github.event.release.id }}"
    steps:

      #############################
      ##                         ##
      ##    Edit Release Body    ##
      ##     (build pending)     ##
      ##                         ##
      #############################

      - name: "Update Release Title & Description"
        uses: actions/github-script@v8
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            github.rest.repos.updateRelease({
              owner: context.repo.owner,
              repo: context.repo.repo,
              release_id: context.payload.release.id,
              name: context.payload.release.name + " (Building)",
              body: context.payload.release.body + "\n\n<!-- ACTIONS_REMOVE_AFTER_BUILD -->\n\n---\n\n> [!NOTE]\n> ### This release is currently being built.\n> Build artifacts will be added to this release once the build is complete. For now, you can watch the build progress from [its GitHub Actions page](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}).",
            })

  build-and-publish:
    name: Build & Publish
    needs: [sanity-checks, add-publishing-note]
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      packages: write
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v5.0.0
        with:
          fetch-depth: 0

      - name: Setup Tools
        uses: tanstack/config/.github/setup@9286c261b7c25a2c0342e2a06510f9cd9e4512f6

      - name: Set package.json Version Field to the Release's Tag
        if: github.event.release != null
        uses: BellCubeDev/update-package-version-by-release-tag@v2
        with:
          ignore-semver-check: "true"


      ###########################
      ##                       ##
      ##    Build & Package    ##
      ##                       ##
      ###########################

      - name: Run Build
        run: pnpm run build

      - name: PNPM Pack
        run: |
          pnpm pack

      #############################
      ##                         ##
      ##    Release Artifacts    ##
      ##                         ##
      #############################

      - name: "Upload Files to Release"
        if: github.event.release != null
        uses: AButler/upload-release-assets@v3.0
        with:
          files: "*.tgz"
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          release-id: ${{ github.event.release.id }}

      ########################
      ##                    ##
      ##    NPM Registry    ##
      ##                    ##
      ########################

      - id: publish-npm
        name: Publish to NPM Registry
        # Uses OIDC token to authenticate, so no need to set up a secret for this
        # This does restrict us to only using base `npm`, though 🙁
        run: |
          pnpm dlx npm publish --access public --registry https://registry.npmjs.org/ --tag ${{ github.event.release.prerelease && 'next' || 'latest' }} --provenance

      - name: ON FAILURE - cat NPM debug log for "Publish to NPM Registry"
        if: always() && steps.publish-npm.outcome == 'failure'
        run: |
          echo "ACTIONS_ID_TOKEN_REQUEST_URL: $ACTIONS_ID_TOKEN_REQUEST_URL"
          echo "ACTIONS_ID_TOKEN_REQUEST_TOKEN is set: ${{ env.ACTIONS_ID_TOKEN_REQUEST_TOKEN != '' }}"
          echo ""
          echo ""
          cat ~/.npm/_logs/*.log || echo "No NPM log file found"

      #############################
      ##                         ##
      ##    Edit Release Body    ##
      ##     (build success)     ##
      ##                         ##
      #############################

      - name: "Update Release Title & Description"
        if: github.event.release != null
        uses: actions/github-script@v8
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            github.rest.repos.updateRelease({
              owner: context.repo.owner,
              repo: context.repo.repo,
              release_id: context.payload.release.id,
              name: context.payload.release.name.replace(/\s+\(Building\)$/, ''),
              body: context.payload.release.body.replace(/<!-- ACTIONS_REMOVE_AFTER_BUILD -->[\s\S]*$/, '') + "\n\n---\n\n##### Built successfully by [GitHub Actions run #${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}).",
            })


  note-release-build-failed:
    permissions:
      contents: write
      id-token: none
    name: "Note Release Build Failed"
    needs: [build-and-publish]
    if: failure() && github.event.release != null
    runs-on: ubuntu-latest
    concurrency:
      group: "release-editing-${{ github.event.release.id }}"
    steps:

      #############################
      ##                         ##
      ##    Edit Release Body    ##
      ##     (build failure)     ##
      ##                         ##
      #############################

    - name: "Update Release Title & Description"
      uses: actions/github-script@v7
      with:
        github-token: ${{ secrets.GITHUB_TOKEN }}
        script: |
          github.rest.repos.updateRelease({
            owner: context.repo.owner,
            repo: context.repo.repo,
            release_id: context.payload.release.id,
            name: context.payload.release.name.replace(/\s+\(Building\)$/, '') + " (Failed)",
            body: "> [!CAUTION]\n> ### This Release's Build Failed\n> The build for this release failed. You can see where and why the build failed in [its GitHub Action page](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}).\n\n---\n\n" + context.payload.release.body.replace(/<!-- ACTIONS_REMOVE_AFTER_BUILD -->[\s\S]*$/, ''),
          })