monthly-pro-content-release.yml

# Monthly Pro Content Release Pipeline
#
# Runs on the 1st of each month at 08:00 UTC (+ manual dispatch).
# Generates verified Pro audio updates via ElevenLabs, then dispatches store release automation.
# Public store availability must still be proven by store read-back; App Review timing is not guaranteed.
#
# Required Secrets:
#   ELEVENLABS_API_KEY  — ElevenLabs API key (voice callouts + sound generation)
#   PROJECT_PAT         — GitHub PAT with repo + workflow scopes
#
# Optional Secrets:
#   FREESOUND_API_TOKEN — Freesound OAuth token (bonus CC0 sound effects)
#
# Store publishing secrets (Android + iOS) are documented in native-release.yml.

name: Monthly Pro Content Release

on:
  schedule:
    - cron: "0 8 1 * *"
  workflow_dispatch:
    inputs:
      skip_voice:
        description: "Skip ElevenLabs voice callout generation (sounds only)"
        type: boolean
        default: false
      dry_run:
        description: "Dry-run: generate content but do not commit or publish"
        type: boolean
        default: false

concurrency:
  group: monthly-pro-content-release
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  # ============================================================
  # Job 1 — Generate new audio content
  # ============================================================
  generate-content:
    name: "Generate monthly audio content"
    runs-on: ubuntu-latest
    timeout-minutes: 45
    permissions:
      contents: write
      pull-requests: write
    outputs:
      content_branch: ${{ steps.commit.outputs.content_branch }}
      new_version: ${{ steps.bump.outputs.new_version }}
      month_label: ${{ steps.meta.outputs.month_label }}
      release_month: ${{ steps.meta.outputs.release_month }}
      changes_committed: ${{ steps.commit.outputs.changes_committed }}
      content_pr_number: ${{ steps.commit.outputs.content_pr_number }}

    steps:
      - name: Validate required secrets
        env:
          PROJECT_PAT: ${{ secrets.PROJECT_PAT }}
          ELEVENLABS_API_KEY: ${{ secrets.ELEVENLABS_API_KEY }}
        run: |
          set -euo pipefail
          missing=()
          if [ -z "${PROJECT_PAT}" ]; then missing+=("PROJECT_PAT"); fi
          if [ -z "${ELEVENLABS_API_KEY}" ]; then missing+=("ELEVENLABS_API_KEY"); fi
          if [ "${#missing[@]}" -gt 0 ]; then
            printf '::error::Missing required secret(s): %s\n' "${missing[*]}"
            exit 1
          fi
          echo "All required secrets present. ElevenLabs is the primary audio engine."

      - name: Checkout develop
        uses: actions/checkout@v4
        with:
          ref: develop
          fetch-depth: 0
          token: ${{ secrets.PROJECT_PAT }}

      - name: Compute month label
        id: meta
        run: |
          MONTH_LABEL=$(date -u +"%B-%Y")
          RELEASE_MONTH=$(date -u +"%Y-%m")
          echo "month_label=${MONTH_LABEL}" >> "$GITHUB_OUTPUT"
          echo "release_month=${RELEASE_MONTH}" >> "$GITHUB_OUTPUT"

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Generate voice callouts + sound arsenal via ElevenLabs
        env:
          ELEVENLABS_API_KEY: ${{ secrets.ELEVENLABS_API_KEY }}
          SKIP_VOICE: ${{ github.event_name == 'workflow_dispatch' && inputs.skip_voice == true && 'true' || 'false' }}
        run: |
          set -euo pipefail
          echo "=== Generating Pro audio content via ElevenLabs ==="
          args=(
            --manifest content/pro_audio/monthly_pro_audio_packs.json
            --release-month "${{ steps.meta.outputs.release_month }}"
            --voice-id "${ELEVENLABS_VOICE_ID:-2EiwWnXFnvU5JabPnv8n}"
            --generate-sound-assets
            --sync-android-assets
          )
          if [ "${SKIP_VOICE}" != "true" ]; then
            args+=(--generate-voice-assets)
          fi
          python scripts/generate_pro_audio_content.py "${args[@]}"

      - name: Fetch bonus CC0 sounds from Freesound (optional)
        env:
          FREESOUND_API_TOKEN: ${{ secrets.FREESOUND_API_TOKEN }}
          ELEVENLABS_API_KEY: ${{ secrets.ELEVENLABS_API_KEY }}
        run: |
          set -euo pipefail
          if [ -z "${FREESOUND_API_TOKEN}" ]; then
            echo "FREESOUND_API_TOKEN not configured; skipping optional Freesound fetch."
            exit 0
          fi
          echo "=== Fetching bonus CC0 sounds from Freesound ==="
          python scripts/generate_monthly_audio_pack.py --skip-voice || echo "::warning::Freesound fetch failed — continuing with ElevenLabs content only"

      - name: Sync generated audio to Android
        run: |
          set -euo pipefail
          synced=0
          # Sync voice callouts
          for f in native-ios/RandomTimer/Resources/Audio/cmd_*.mp3 \
                   native-ios/RandomTimer/Resources/Audio/elapsed_*.mp3; do
            [ -f "$f" ] || continue
            name=$(basename "$f")
            cp "$f" "native-android/app/src/main/res/raw/${name}"
            echo "Synced ${name}"
            synced=$((synced + 1))
          done
          # Sync alarm / timer sounds
          for f in native-ios/RandomTimer/Resources/Sounds/*.mp3; do
            [ -f "$f" ] || continue
            name=$(basename "$f")
            android_name="${name//-/_}"
            cp "$f" "native-android/app/src/main/res/raw/${android_name}"
            echo "Synced sound ${android_name}"
            synced=$((synced + 1))
          done
          echo "Total files synced to Android: ${synced}"

      - name: Bump patch version
        id: bump
        env:
          DRY_RUN_INPUT: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run == true && 'true' || 'false' }}
        run: |
          set -euo pipefail
          MONTH_LABEL="${{ steps.meta.outputs.month_label }}"
          CHANGELOG_MSG="Monthly Pro content update — ${MONTH_LABEL//-/ }"

          DRY_RUN_FLAG=""
          if [ "${DRY_RUN_INPUT}" = "true" ]; then
            DRY_RUN_FLAG="--dry-run"
          fi

          OUTPUT=$(python scripts/bump_patch_version.py \
            --changelog-message "${CHANGELOG_MSG}" \
            ${DRY_RUN_FLAG})
          echo "$OUTPUT"

          NEW_VERSION=$(echo "$OUTPUT" | grep "^New version:" | awk '{print $NF}')
          echo "new_version=${NEW_VERSION}" >> "$GITHUB_OUTPUT"

      - name: Commit and push via PR branch
        id: commit
        env:
          GITHUB_TOKEN: ${{ secrets.PROJECT_PAT }}
          DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run == true && 'true' || 'false' }}
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

          MONTH_TAG=$(date -u +"%Y-%m")
          CONTENT_BRANCH="feat/monthly-content-${MONTH_TAG}"
          echo "content_branch=${CONTENT_BRANCH}" >> "$GITHUB_OUTPUT"

          # Stage all audio and version files
          paths=(
            "native-ios/RandomTimer/Resources/Audio/"
            "native-ios/RandomTimer/Resources/Sounds/"
            "native-android/app/src/main/res/raw/"
            "native-android/app/src/main/assets/"
            "native-android/app/build.gradle.kts"
            "native-ios/RandomTimer.xcodeproj/project.pbxproj"
            "native-android/fastlane/metadata/"
            "native-ios/fastlane/metadata/"
            "content/pro_audio/"
          )
          for path in "${paths[@]}"; do
            if [ -e "$path" ]; then
              git add "$path"
            fi
          done

          if git diff --cached --quiet; then
            echo "No changes to commit."
            echo "changes_committed=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          if [ "${DRY_RUN}" = "true" ]; then
            echo "[dry-run] Would commit staged changes."
            echo "changes_committed=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          git checkout -b "${CONTENT_BRANCH}"
          MONTH_LABEL="${{ steps.meta.outputs.month_label }}"
          NEW_VERSION="${{ steps.bump.outputs.new_version }}"
          git commit -m "feat(audio): monthly Pro content update for ${MONTH_LABEL//-/ } — v${NEW_VERSION}"
          git push origin "${CONTENT_BRANCH}"

          # Create PR from content branch to develop
          if gh pr view "${CONTENT_BRANCH}" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            echo "PR already exists for ${CONTENT_BRANCH}."
          else
            gh pr create \
              --base develop \
              --head "${CONTENT_BRANCH}" \
              --title "feat(audio): Monthly Pro content — ${MONTH_LABEL//-/ } (v${NEW_VERSION})" \
              --body "Auto-generated monthly Pro content update. New voice callouts + sound arsenal for ${MONTH_LABEL//-/ }. Version bump to ${NEW_VERSION}." \
              --repo "$GITHUB_REPOSITORY"
          fi
          PR_NUMBER=$(gh pr view "${CONTENT_BRANCH}" --repo "$GITHUB_REPOSITORY" --json number --jq '.number')
          echo "content_pr_number=${PR_NUMBER}" >> "$GITHUB_OUTPUT"

          echo "changes_committed=true" >> "$GITHUB_OUTPUT"

      - name: Upload audio content artifact
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: monthly-audio-pack-${{ steps.meta.outputs.month_label }}
          path: |
            native-ios/RandomTimer/Resources/Audio/
            native-ios/RandomTimer/Resources/Sounds/
            native-android/app/src/main/res/raw/
          if-no-files-found: warn
          retention-days: 1

  # ============================================================
  # Job 2 — Merge content PR into develop + cut release
  # ============================================================
  merge-and-cut-release:
    name: "Merge content PR + cut release branch"
    needs: [generate-content]
    if: needs.generate-content.outputs.changes_committed == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 60
    permissions:
      contents: write
      pull-requests: write
    outputs:
      release_branch: ${{ steps.cut.outputs.release_branch }}
      release_version: ${{ steps.cut.outputs.release_version }}

    steps:
      - name: Checkout develop
        uses: actions/checkout@v4
        with:
          ref: develop
          fetch-depth: 0
          token: ${{ secrets.PROJECT_PAT }}

      - name: Merge content PR into develop
        id: merge
        env:
          GH_TOKEN: ${{ secrets.PROJECT_PAT }}
          CONTENT_PR_NUMBER: ${{ needs.generate-content.outputs.content_pr_number }}
        run: |
          set -euo pipefail

          if [ -z "${CONTENT_PR_NUMBER}" ]; then
            echo "::error::Missing generated content PR number."
            exit 1
          fi

          # Squash-merge directly with PROJECT_PAT (no Trunk queue — May 2026 run timed out at 55m).
          gh pr merge "${CONTENT_PR_NUMBER}" \
            --repo "$GITHUB_REPOSITORY" \
            --squash \
            --delete-branch || true

          deadline=$((SECONDS + 900))
          while [ "$SECONDS" -lt "$deadline" ]; do
            state_json=$(gh pr view "${CONTENT_PR_NUMBER}" \
              --repo "$GITHUB_REPOSITORY" \
              --json state,mergedAt,mergeCommit)
            state=$(echo "$state_json" | jq -r '.state')
            merged_at=$(echo "$state_json" | jq -r '.mergedAt // ""')
            merge_sha=$(echo "$state_json" | jq -r '.mergeCommit.oid // ""')

            if [ -n "$merged_at" ] && [ -n "$merge_sha" ]; then
              echo "content_merge_sha=${merge_sha}" >> "$GITHUB_OUTPUT"
              echo "Content PR #${CONTENT_PR_NUMBER} merged at ${merged_at}: ${merge_sha}"
              exit 0
            fi

            if [ "$state" = "CLOSED" ]; then
              echo "::error::Content PR #${CONTENT_PR_NUMBER} closed without merge."
              exit 1
            fi

            echo "Waiting for content PR #${CONTENT_PR_NUMBER} merge..."
            sleep 15
          done

          echo "::error::Timed out waiting for content PR #${CONTENT_PR_NUMBER} to merge into develop."
          exit 1

      - name: Cut release branch
        id: cut
        env:
          GITHUB_TOKEN: ${{ secrets.PROJECT_PAT }}
          NEW_VERSION: ${{ needs.generate-content.outputs.new_version }}
          CONTENT_MERGE_SHA: ${{ steps.merge.outputs.content_merge_sha }}
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git fetch origin develop
          git checkout develop
          git reset --hard origin/develop
          if ! git merge-base --is-ancestor "${CONTENT_MERGE_SHA}" HEAD; then
            echo "::error::origin/develop does not contain content merge ${CONTENT_MERGE_SHA}."
            exit 1
          fi
          RELEASE_BRANCH="release/v${NEW_VERSION}"
          git fetch origin "${RELEASE_BRANCH}" 2>/dev/null || true
          if git ls-remote --exit-code --heads origin "${RELEASE_BRANCH}" >/dev/null 2>&1; then
            echo "Release branch ${RELEASE_BRANCH} already exists; fast-forwarding to origin/develop."
            git checkout -B "${RELEASE_BRANCH}"
          else
            git checkout -b "${RELEASE_BRANCH}"
          fi
          git push origin "${RELEASE_BRANCH}" --force-with-lease
          echo "release_branch=${RELEASE_BRANCH}" >> "$GITHUB_OUTPUT"
          echo "release_version=${NEW_VERSION}" >> "$GITHUB_OUTPUT"

  # ============================================================
  # Job 3 — Regression tests on release branch
  # ============================================================
  regression-gate:
    name: "Regression tests"
    needs: [merge-and-cut-release]
    if: needs.merge-and-cut-release.outputs.release_branch != ''
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
    steps:
      - name: Checkout release branch
        uses: actions/checkout@v4
        with:
          ref: ${{ needs.merge-and-cut-release.outputs.release_branch }}

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install test dependencies
        run: pip install pytest

      - name: Run regression tests
        run: |
          set -euo pipefail
          echo "Running regression suite on release branch..."
          test_files=()
          for f in \
            scripts/tests/test_pro_lock_parity.py \
            scripts/tests/test_audio_asset_regressions.py \
            scripts/tests/test_store_metadata_copy.py \
            scripts/tests/test_voice_regression_contracts.py \
            scripts/tests/test_mobile_analytics_parity.py; do
            if [ -f "$f" ]; then
              test_files+=("$f")
            fi
          done
          if [ "${#test_files[@]}" -eq 0 ]; then
            echo "::warning::No regression test files found — skipping."
            exit 0
          fi
          python -m pytest "${test_files[@]}" -v --tb=short

  # ============================================================
  # Job 4 — Submit store release
  # ============================================================
  publish-production:
    name: "Submit App Store + publish Play Store"
    needs: [generate-content, merge-and-cut-release, regression-gate]
    if: needs.merge-and-cut-release.outputs.release_branch != '' && needs.regression-gate.result == 'success'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      actions: write

    steps:
      - name: Dispatch Native App Release
        env:
          GH_TOKEN: ${{ secrets.PROJECT_PAT }}
          RELEASE_BRANCH: ${{ needs.merge-and-cut-release.outputs.release_branch }}
          RELEASE_VERSION: ${{ needs.merge-and-cut-release.outputs.release_version }}
        run: |
          set -euo pipefail
          gh workflow run "Native App Release" \
            --repo "$GITHUB_REPOSITORY" \
            --ref "${RELEASE_BRANCH}" \
            -f platform=both \
            -f android_track=production \
            -f submit_review=true \
            -f confirm_ios_only_release=false \
            -f skip_internal_signoff=false \
            -f skip_production_signoff=true
          echo "Dispatched Native App Release for ${RELEASE_BRANCH}"

      - name: Pipeline summary
        env:
          RELEASE_VERSION: ${{ needs.merge-and-cut-release.outputs.release_version }}
          MONTH_LABEL: ${{ needs.generate-content.outputs.month_label }}
          RELEASE_BRANCH: ${{ needs.merge-and-cut-release.outputs.release_branch }}
        run: |
          cat >> "$GITHUB_STEP_SUMMARY" <<SUMMARY
          ## Monthly Pro Content Release — Dispatch Complete

          | Field           | Value                                              |
          |-----------------|----------------------------------------------------|
          | Version         | ${RELEASE_VERSION}                                 |
          | Month           | ${MONTH_LABEL//-/ }                                |
          | Release branch  | ${RELEASE_BRANCH}                                  |
          | Platforms       | iOS App Review submission + Android Play production |

          Native App Release dispatched. Use that run for final store-upload evidence.
          Public store availability must still be proven by public-store-version-readback.yml before publication is claimed.
          SUMMARY