release.yml

# Manual distribution workflow. Push a v* tag first; `Release Prepare` runs the
# test suites and builds the FFI libraries + npm package. Then run this workflow
# with that tag and the successful prepare run ID.
#
# The npm publish and the GitHub Release consume the prepare run's artifacts by
# run ID — nothing is recompiled to fix a crates.io timeout, an npm hiccup, or a
# bad release body. A failed stage is retried by re-dispatching with only that
# stage enabled.
#
# Stages, in dependency order:
#   publish_crates  -> crates.io, 2 tiers (nodedb-lite, then -ffi + -wasm)
#   publish_npm     -> @nodedb/lite on npm (from the prepared pkg/)
#   github_release  -> GitHub Release with the FFI archives attached
#
# Each stage is idempotent: crates already indexed are skipped, an existing npm
# version is skipped, and the release is overwritten in place. Re-running the
# whole thing is safe; the toggles exist to save time, not to prevent
# double-publishing.
#
# Required secrets: CARGO_REGISTRY_TOKEN, NPM_TOKEN.

name: Release
run-name: Release ${{ inputs.tag }}

on:
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag to publish, e.g. v0.1.0"
        required: true
        type: string
      prepare_run_id:
        description: "Successful Release Prepare run ID holding the artifacts"
        required: true
        type: string
      ref:
        description: "Ref to take workflow/scripts from. Defaults to the tag; override to pick up a distribution-only fix without re-tagging."
        required: false
        type: string
      publish_crates:
        description: "Publish crates to crates.io"
        type: boolean
        default: true
      publish_npm:
        description: "Publish @nodedb/lite to npm"
        type: boolean
        default: true
      github_release:
        description: "Create the GitHub Release"
        type: boolean
        default: true

concurrency:
  group: release
  cancel-in-progress: false

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

jobs:
  # Always runs. Cheap, and it guarantees the dispatched tag still means what the
  # prepare run assumed it meant.
  validate-version:
    uses: ./.github/workflows/release-validate.yml
    with:
      ref: ${{ inputs.tag }}

  # ── crates.io ────────────────────────────────────────────────────────────────
  # Tier 1: nodedb-lite (no internal Lite deps).
  # Tier 2: nodedb-lite-ffi, nodedb-lite-wasm (both depend on nodedb-lite).
  # is_published / wait_for polling means a re-run never double-publishes an
  # already-indexed crate and never races the index for the tier-1 dep it just
  # pushed.
  publish-crates:
    name: Publish to crates.io
    needs: validate-version
    if: inputs.publish_crates
    runs-on: ubuntu-latest
    environment: crates.io
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.tag }}

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Install system deps
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            cmake clang libclang-dev pkg-config protobuf-compiler perl

      - name: Set version from tag
        run: bash scripts/ci/stamp_version.sh "${{ needs.validate-version.outputs.version }}"

      - name: Publish crates
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: |
          TIER1="nodedb-lite"
          TIER2="nodedb-lite-ffi nodedb-lite-wasm"

          is_published() {
            curl -sf \
              -H "User-Agent: nodedb-lite-ci (github.com/NodeDB-Lab/nodedb-lite)" \
              "https://crates.io/api/v1/crates/$1/$2" > /dev/null 2>&1
          }

          wait_for() {
            local crate="$1" version="$2"
            echo -n "  Waiting for $crate@$version..."
            for i in $(seq 1 30); do
              if is_published "$crate" "$version"; then
                echo " ready"
                return 0
              fi
              sleep 5
            done
            echo " timed out!"
            return 1
          }

          publish_tier() {
            local tier_name="$1"; shift
            local crates=("$@")
            local need_wait=()

            echo "::group::Tier: $tier_name"
            for crate in "${crates[@]}"; do
              VERSION=$(cargo metadata --no-deps --format-version=1 \
                | jq -r --arg name "$crate" '.packages[] | select(.name == $name) | .version')
              if is_published "$crate" "$VERSION"; then
                echo "  $crate@$VERSION already published — skipping"
              else
                echo "  Publishing $crate@$VERSION..."
                cargo publish -p "$crate" --allow-dirty --no-verify
                need_wait+=("$crate:$VERSION")
              fi
            done

            for entry in "${need_wait[@]}"; do
              wait_for "${entry%%:*}" "${entry##*:}"
            done
            echo "::endgroup::"
          }

          publish_tier "1 (no internal Lite deps)"  $TIER1
          publish_tier "2 (depends on nodedb-lite)" $TIER2

  # ── npm ──────────────────────────────────────────────────────────────────────
  # Publishes the pkg/ the prepare run already built — no wasm recompile. Skips
  # cleanly if the version is already on npm, so a re-run is safe.
  publish-npm:
    name: Publish to npm
    needs: validate-version
    if: inputs.publish_npm
    runs-on: ubuntu-latest
    environment: npm
    permissions:
      contents: read
      actions: read
    steps:
      - name: Download prepared npm package
        uses: actions/download-artifact@v8
        with:
          name: npm-pkg
          run-id: ${{ inputs.prepare_run_id }}
          github-token: ${{ github.token }}
          path: ./pkg

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          registry-url: https://registry.npmjs.org

      - name: Publish to npm
        working-directory: ./pkg
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          IS_FULL: ${{ needs.validate-version.outputs.is_full_release }}
        run: |
          set -euo pipefail
          NAME=$(node -p "require('./package.json').name")
          VERSION=$(node -p "require('./package.json').version")

          if npm view "${NAME}@${VERSION}" version >/dev/null 2>&1; then
            echo "${NAME}@${VERSION} already published — skipping"
            exit 0
          fi

          if [[ "$IS_FULL" == "true" ]]; then
            npm publish --access public
          else
            npm publish --access public --tag beta
          fi

  # ── GitHub Release ───────────────────────────────────────────────────────────
  # Independent of the publish stages: a registry outage must not block cutting
  # the release, and re-running this stage alone is the fix for a bad release
  # body. Attaches every FFI archive built by the prepare run.
  github-release:
    name: Create GitHub Release
    needs: validate-version
    if: inputs.github_release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      actions: read
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.ref || inputs.tag }}

      - name: Download FFI artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: "ffi-*"
          run-id: ${{ inputs.prepare_run_id }}
          github-token: ${{ github.token }}
          path: ./artifacts
          merge-multiple: true

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ inputs.tag }}
          name: NodeDB Lite ${{ needs.validate-version.outputs.version }}
          generate_release_notes: true
          draft: false
          prerelease: ${{ needs.validate-version.outputs.is_full_release != 'true' }}
          files: artifacts/*
          fail_on_unmatched_files: true