release.yml

name: Release (early subset)

# Manual, provenance-backed npm publish for the FIRST release wave ONLY:
#   - 9 @rozie/* toolchain packages (core, cli, unplugin, babel-plugin,
#     runtime-{react,vue,svelte,solid,lit})
#   - 6 @rozie-ui Vue leaves: flatpickr / sortable-list / cropper /
#     fullcalendar / pdf / captcha (the `-vue` packages). captcha-vue was added
#     to dogfood it; like the others it is self-contained (zero @rozie/* deps,
#     dist externalizes only vue), so it publishes standalone.
#   - 5 non-vue @rozie-ui captcha leaves: captcha-{react,solid,lit,svelte,angular}.
#     These are now IN scope: they depend on @rozie/runtime-* (react/solid/lit/svelte),
#     and that prerequisite is satisfied — @rozie/runtime-* is live on npm at 0.1.1,
#     which pnpm rewrites the leaves' `workspace:` deps to at publish. angular carries
#     no @rozie dep (tslib only). This is the FIRST all-targets captcha release line
#     (all 6 leaves aligned at 0.1.3).
#   - 5 non-vue @rozie-ui sortable-list leaves: sortable-list-{react,solid,lit,svelte,angular}.
#     Now IN scope alongside sortable-list-vue (all 6 aligned at 0.1.5) — the svelte +
#     angular leaves were upgraded to the compiled dist+source standard, so all 6 ship
#     proper drop-in packages. react/solid/lit/svelte carry @rozie/runtime-* (rewritten
#     from `workspace:` at publish; live on npm at 0.1.1); angular carries no @rozie dep.
#
# Everything else is DELIBERATELY out of scope: the react/solid/svelte/lit/angular
# leaves of OTHER families (flatpickr, cropper, fullcalendar, pdf) are not
# release-verified, and data-table is not release-verified. Do NOT widen the
# --filter lists below to other families without updating the release runbook.
#
# Prerequisites:
#   - Repo is PUBLIC (npm provenance requires a public source repo) — verified.
#   - Secret NPM_TOKEN = an npm automation/granular token with publish rights to
#     BOTH the @rozie and @rozie-ui scopes.
#   - `id-token: write` (below) lets npm mint the provenance attestation via
#     GitHub OIDC; without it, --provenance fails.
#
# SAFETY: dry_run defaults to TRUE. The first runs pack + validate but do NOT
# publish. To actually publish, dispatch with dry_run = false.

on:
  workflow_dispatch:
    inputs:
      dry_run:
        description: 'Dry run (pack + validate only; do NOT publish)'
        type: boolean
        default: true

concurrency:
  group: release
  cancel-in-progress: false

permissions:
  contents: read
  id-token: write # required for npm provenance (OIDC)

jobs:
  release:
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v6

      - uses: pnpm/action-setup@v6

      - uses: actions/setup-node@v6
        with:
          node-version: 20
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # Build ONLY the 9 toolchain packages. We list them explicitly rather than
      # --filter='@rozie/*' because that glob also matches @rozie/docs and would
      # drag in the heavy (OOM-prone) VitePress build. The 5 Vue leaves are built
      # separately (the "Build Vue leaves" step below) into a compiled dist/
      # drop-in (Vite lib mode + vue-tsc declaration emit) — they no longer ship
      # raw .vue source only.
      - name: Build toolchain
        run: >
          pnpm turbo run build --force
          --filter=@rozie/core
          --filter=@rozie/cli
          --filter=@rozie/unplugin
          --filter=@rozie/babel-plugin
          --filter=@rozie/runtime-react
          --filter=@rozie/runtime-vue
          --filter=@rozie/runtime-svelte
          --filter=@rozie/runtime-solid
          --filter=@rozie/runtime-lit

      # Append the registry auth line to the existing project .npmrc. The token
      # placeholder is left LITERAL here and expanded by pnpm at publish time
      # from the NODE_AUTH_TOKEN env on the publish steps below.
      - name: Configure npm auth
        run: |
          {
            echo "registry=https://registry.npmjs.org/"
            echo '//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}'
          } >> .npmrc

      - name: Resolve publish flags
        id: flags
        run: |
          if [ "${{ inputs.dry_run }}" = "true" ]; then
            echo "extra=--dry-run" >> "$GITHUB_OUTPUT"
            echo "::notice::DRY RUN — packing and validating only, nothing will be published."
          else
            echo "extra=" >> "$GITHUB_OUTPUT"
            echo "::warning::LIVE PUBLISH — packages will be pushed to npm."
          fi

      # Toolchain first. pnpm rewrites workspace:* to the concrete 0.1.0 version
      # in the tarball; npm publish does NOT, so this MUST go through pnpm.
      - name: Publish toolchain (@rozie/*)
        run: >
          pnpm
          --filter=@rozie/core
          --filter=@rozie/cli
          --filter=@rozie/unplugin
          --filter=@rozie/babel-plugin
          --filter=@rozie/runtime-react
          --filter=@rozie/runtime-vue
          --filter=@rozie/runtime-svelte
          --filter=@rozie/runtime-solid
          --filter=@rozie/runtime-lit
          publish --access public --no-git-checks --provenance ${{ steps.flags.outputs.extra }}
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_CONFIG_PROVENANCE: 'true'

      # Build the 6 Vue leaves into their compiled dist/ drop-in (Vite lib mode +
      # vue-tsc declaration emit). Each leaf's `build` script needs only its own
      # devDeps (already installed by the frozen install above); it does NOT run
      # codegen and does NOT depend on @rozie/core, so running it after the
      # toolchain build is fine. (captcha-vue likewise carries zero @rozie/* deps —
      # its dist bundles the vendored internal/ loader, externalizing only vue.)
      - name: Build Vue leaves
        run: >
          pnpm
          --filter=@rozie-ui/flatpickr-vue
          --filter=@rozie-ui/sortable-list-vue
          --filter=@rozie-ui/cropper-vue
          --filter=@rozie-ui/fullcalendar-vue
          --filter=@rozie-ui/pdf-vue
          --filter=@rozie-ui/captcha-vue
          build

      # Build the 5 non-vue captcha leaves into their compiled dist/ drop-in. Each
      # leaf's `build` script encodes its per-target idiom (tsdown for
      # react/solid/lit, svelte-package for svelte, ng-packagr for angular). This
      # step sits AFTER the toolchain build so the local @rozie/runtime-* dist exists
      # for type resolution during the leaf builds.
      - name: Build non-vue captcha leaves
        run: >
          pnpm
          --filter=@rozie-ui/captcha-react
          --filter=@rozie-ui/captcha-solid
          --filter=@rozie-ui/captcha-lit
          --filter=@rozie-ui/captcha-svelte
          --filter=@rozie-ui/captcha-angular
          build

      # Build the 5 non-vue sortable-list leaves into their compiled dist/ drop-in.
      # Mixed per-target toolchain: react/solid/lit build via tsdown, svelte via
      # @sveltejs/package (svelte-package -> dist/SortableList.svelte + .svelte.d.ts),
      # angular via ng-packagr (APF fesm2022 + dist/index.d.ts). Sits AFTER the
      # toolchain build so the local @rozie/runtime-* dist exists for type resolution
      # during the react/solid/lit/svelte leaf builds (angular has no @rozie dep).
      - name: Build non-vue sortable-list leaves
        run: >
          pnpm
          --filter=@rozie-ui/sortable-list-react
          --filter=@rozie-ui/sortable-list-solid
          --filter=@rozie-ui/sortable-list-lit
          --filter=@rozie-ui/sortable-list-svelte
          --filter=@rozie-ui/sortable-list-angular
          build

      # Build the 5 non-vue flatpickr leaves into their compiled dist/ drop-in.
      # Same mixed toolchain as sortable-list (react/solid/lit tsdown, svelte
      # @sveltejs/package, angular ng-packagr APF). Sits AFTER the toolchain build
      # so the local @rozie/runtime-* dist exists for the react/solid/lit/svelte
      # leaf type resolution (angular = tslib only, no @rozie dep).
      - name: Build non-vue flatpickr leaves
        run: >
          pnpm
          --filter=@rozie-ui/flatpickr-react
          --filter=@rozie-ui/flatpickr-solid
          --filter=@rozie-ui/flatpickr-lit
          --filter=@rozie-ui/flatpickr-svelte
          --filter=@rozie-ui/flatpickr-angular
          build

      # ADVISORY structural pre-check. Runs AFTER every leaf dist exists (the
      # toolchain already published at the earlier "Publish toolchain" step; the
      # Vue + non-vue leaves were just built above) and BEFORE the first leaf
      # publish, so it sees real artifacts. It is deliberately:
      #   * AUDIT mode (NOT --gate): already-published is the EXPECTED steady
      #     state, not a failure.
      #   * --skip-npm: network-free + timing-independent — only the deterministic
      #     structural checks run (description quality, repository url/directory
      #     accuracy, files + exports resolving on disk).
      #   * continue-on-error: true: it NEVER blocks a publish; it only surfaces
      #     structural problems in the run log.
      # It CANNOT be a hard gate here because (1) the toolchain already published
      # earlier in THIS run — there is no "all built, nothing published" moment —
      # and (2) in a combined toolchain+leaf release the freshly-bumped
      # @rozie/runtime-* is not on npm yet when the leaves build, so a version/dep
      # check would false-fail. Those TIMING-SENSITIVE checks (version-vs-npm,
      # workspace-dep-on-npm) live in the releaser's LOCAL pre-flight
      # `pnpm release:precheck --gate` (run before dispatching). See RELEASING.md.
      # Scope mirrors the publish steps' --filter set exactly.
      - name: Release precheck (advisory)
        continue-on-error: true
        run: >
          node scripts/release-precheck.mjs --skip-npm
          --filter @rozie/core
          --filter @rozie/cli
          --filter @rozie/unplugin
          --filter @rozie/babel-plugin
          --filter @rozie/runtime-react
          --filter @rozie/runtime-vue
          --filter @rozie/runtime-svelte
          --filter @rozie/runtime-solid
          --filter @rozie/runtime-lit
          --filter @rozie-ui/flatpickr-vue
          --filter @rozie-ui/sortable-list-vue
          --filter @rozie-ui/cropper-vue
          --filter @rozie-ui/fullcalendar-vue
          --filter @rozie-ui/pdf-vue
          --filter @rozie-ui/captcha-vue
          --filter @rozie-ui/captcha-react
          --filter @rozie-ui/captcha-solid
          --filter @rozie-ui/captcha-lit
          --filter @rozie-ui/captcha-svelte
          --filter @rozie-ui/captcha-angular
          --filter @rozie-ui/sortable-list-react
          --filter @rozie-ui/sortable-list-solid
          --filter @rozie-ui/sortable-list-lit
          --filter @rozie-ui/sortable-list-svelte
          --filter @rozie-ui/sortable-list-angular
          --filter @rozie-ui/flatpickr-react
          --filter @rozie-ui/flatpickr-solid
          --filter @rozie-ui/flatpickr-lit
          --filter @rozie-ui/flatpickr-svelte
          --filter @rozie-ui/flatpickr-angular

      # Then the 6 Vue leaves. They carry zero @rozie/* deps so they don't
      # actually depend on the step above — ordering just keeps the log readable.
      - name: Publish Vue leaves (@rozie-ui/*-vue)
        run: >
          pnpm
          --filter=@rozie-ui/flatpickr-vue
          --filter=@rozie-ui/sortable-list-vue
          --filter=@rozie-ui/cropper-vue
          --filter=@rozie-ui/fullcalendar-vue
          --filter=@rozie-ui/pdf-vue
          --filter=@rozie-ui/captcha-vue
          publish --access public --no-git-checks --provenance ${{ steps.flags.outputs.extra }}
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_CONFIG_PROVENANCE: 'true'

      # The 5 non-vue captcha leaves. pnpm rewrites their `workspace:` deps to the
      # concrete @rozie/runtime-* versions (live on npm at 0.1.1) in the tarball;
      # angular carries no @rozie dep. Inherits dry_run (default TRUE) via
      # steps.flags.outputs.extra and the skip-if-already-published behavior (no
      # --force).
      - name: Publish non-vue captcha leaves (@rozie-ui/*)
        run: >
          pnpm
          --filter=@rozie-ui/captcha-react
          --filter=@rozie-ui/captcha-solid
          --filter=@rozie-ui/captcha-lit
          --filter=@rozie-ui/captcha-svelte
          --filter=@rozie-ui/captcha-angular
          publish --access public --no-git-checks --provenance ${{ steps.flags.outputs.extra }}
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_CONFIG_PROVENANCE: 'true'

      # The 5 non-vue sortable-list leaves. pnpm rewrites their `workspace:` deps to
      # the concrete @rozie/runtime-* versions (live on npm at 0.1.1) in the tarball:
      # react/solid/lit carry @rozie/runtime-<fw> (workspace:* -> 0.1.1 exact), svelte
      # carries @rozie/runtime-svelte (workspace:^ -> ^0.1.1); vue + angular carry no
      # @rozie dep (angular = tslib only). Inherits dry_run (default TRUE) via
      # steps.flags.outputs.extra and the skip-if-already-published behavior (no --force).
      - name: Publish non-vue sortable-list leaves (@rozie-ui/*)
        run: >
          pnpm
          --filter=@rozie-ui/sortable-list-react
          --filter=@rozie-ui/sortable-list-solid
          --filter=@rozie-ui/sortable-list-lit
          --filter=@rozie-ui/sortable-list-svelte
          --filter=@rozie-ui/sortable-list-angular
          publish --access public --no-git-checks --provenance ${{ steps.flags.outputs.extra }}
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_CONFIG_PROVENANCE: 'true'

      # The 5 non-vue flatpickr leaves. pnpm rewrites their `workspace:` deps to the
      # concrete @rozie/runtime-* versions (live on npm at 0.1.3) in the tarball:
      # react/solid/lit carry @rozie/runtime-<fw>, svelte carries @rozie/runtime-svelte
      # (workspace:^ -> ^0.1.3); angular carries no @rozie dep (tslib only). vue is
      # NOT here — it is in the Vue leaves step and is already on npm. Inherits dry_run
      # (default TRUE) and the skip-if-already-published behavior (no --force).
      - name: Publish non-vue flatpickr leaves (@rozie-ui/*)
        run: >
          pnpm
          --filter=@rozie-ui/flatpickr-react
          --filter=@rozie-ui/flatpickr-solid
          --filter=@rozie-ui/flatpickr-lit
          --filter=@rozie-ui/flatpickr-svelte
          --filter=@rozie-ui/flatpickr-angular
          publish --access public --no-git-checks --provenance ${{ steps.flags.outputs.extra }}
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_CONFIG_PROVENANCE: 'true'