release.yml

name: 'Release'

on:
  workflow_call:
    inputs:
      version:
        description: 'Version to be released.'
        required: true
        type: string
      base-branch:
        description: 'The branch that will be used as the origin for the release branch (defaults to repo default branch).'
        required: false
        default: ''
        type: string
      prerelease:
        description: 'Mark this release as a prerelease'
        required: false
        default: false
        type: boolean
      include_changelog_in_release:
        description: 'Include content from CHANGELOG.md in the release notes'
        required: false
        default: false
        type: boolean
      bump_to_rc_after_release:
        description: 'Bump version to next RC after release (for semver repos)'
        required: false
        default: false
        type: boolean
    secrets:
      github_pat:
        # Provide a fine-grained token with the following repository permissions:
        # * Contents: Read and write
        # * Metadata: Read-only (mandatory, default)
        # * Pull requests: Read and write
        description: 'The token used to interact with GitHub'
        required: true
      ssh_private_key:
        description: 'The SSH private key used to sign commits and tags.'
        required: true

env:
  GIT_AUTHOR_NAME: OpenVoxProjectBot
  GIT_AUTHOR_EMAIL: 215568489+OpenVoxProjectBot@users.noreply.github.com
  GIT_COMMITTER_NAME: OpenVoxProjectBot
  GIT_COMMITTER_EMAIL: 215568489+OpenVoxProjectBot@users.noreply.github.com
  SSH_AUTH_SOCK: /tmp/ssh_agent.sock
  BUNDLE_WITH: release

jobs:
  release:
    name: 'Release'
    environment: release
    runs-on: ubuntu-24.04
    if: github.repository_owner == 'OpenVoxProject'
    steps:
      - name: Validate version format
        run: |
          # Agent/Server look like 8.23.0-1 or just 8.23.0
          # puppet-runtime looks like 2025.09.08.1
          if ! echo "${{ inputs.version }}" | grep -qE '^[[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+(-[[:alnum:].]+)?$|^[[:digit:]]{4}\.[[:digit:]]{2}\.[[:digit:]]{2}\.[[:digit:]]+$'; then
            echo "::error::Version '${{ inputs.version }}' does not match expected format (semver like 8.23.0 or calver like 2025.09.08.1)"
            exit 1
          fi

      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          ref: ${{ inputs.base-branch }}
          fetch-depth: 0
          token: ${{ secrets.github_pat }}

      - name: Setup Ruby
        if: inputs.bump_to_rc_after_release || inputs.include_changelog_in_release
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.3'
          bundler-cache: true

      - name: Add SSH key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.ssh_private_key }}" > ~/.ssh/github_actions
          chmod 600 ~/.ssh/github_actions
          ssh-agent -a $SSH_AUTH_SOCK > /dev/null
          ssh-add ~/.ssh/github_actions

      - name: Setup git
        run: |
          git config --global user.email "$GIT_AUTHOR_EMAIL"
          git config --global user.name "$GIT_AUTHOR_NAME"
          git config --global gpg.format ssh
          git config --global user.signingkey ~/.ssh/github_actions
          git config --global commit.gpgsign true
          git config --global tag.gpgsign true

      - name: Check tag doesn't already exist
        run: |
          if git rev-parse "${{ inputs.version }}" >/dev/null 2>&1; then
            echo "::error::Tag '${{ inputs.version }}' already exists!"
            exit 1
          fi

      - name: Extract release notes from CHANGELOG.md
        id: extract_notes
        if: inputs.include_changelog_in_release
        run: |
          ruby << 'EOF'
          version = "${{ inputs.version }}"

          unless File.exist?('CHANGELOG.md')
            warn "::warning::No CHANGELOG.md found, release will use auto-generated notes only"
            File.write(ENV['GITHUB_OUTPUT'], "has_notes=false\n", mode: 'a')
            exit 0
          end

          changelog = File.read('CHANGELOG.md')

          # Match ## [VERSION]...\n then capture everything until the next ## [ or end of file
          match = changelog.match(/^## \[#{Regexp.escape(version)}\][^\n]*\n(?<notes>.+?)(?=^## \[|\z)/m)

          unless match
            warn "::warning::Could not find version #{version} in CHANGELOG.md, release will use auto-generated notes only"
            File.write(ENV['GITHUB_OUTPUT'], "has_notes=false\n", mode: 'a')
            exit 0
          end

          notes = match[:notes].strip

          if notes.empty?
            warn "::warning::Version #{version} section is empty, release will use auto-generated notes only"
            File.write(ENV['GITHUB_OUTPUT'], "has_notes=false\n", mode: 'a')
            exit 0
          end

          File.write('release_notes.md', notes)
          File.write(ENV['GITHUB_OUTPUT'], "has_notes=true\n", mode: 'a')
          puts "Extracted release notes for version #{version}"
          EOF

      - name: Create signed tag
        run: |
          git tag -s -m "Release ${{ inputs.version }}" "${{ inputs.version }}"
          git push origin "${{ inputs.version }}"

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ secrets.github_pat }}
        run: |
          RELEASE_ARGS=(
            "${{ inputs.version }}"
            --title "${{ inputs.version }}"
            --generate-notes
          )

          if [ "${{ inputs.prerelease }}" = "true" ]; then
            RELEASE_ARGS+=(--prerelease)
          fi

          if [ "${{ steps.extract_notes.outputs.has_notes }}" = "true" ]; then
            RELEASE_ARGS+=(--notes-file release_notes.md)
          fi

          gh release create "${RELEASE_ARGS[@]}"

      - name: Compute the next RC version
        id: future_version
        if: inputs.bump_to_rc_after_release
        run: |
          ruby << EOF >> "$GITHUB_OUTPUT"
          c = "${{ inputs.version }}".split(".")
          next_version = if c[-1] =~ /\A(\d+-rc)(\d+)\z/
            c[-1] = "#{\$1}#{\$2.succ}"
            c.join(".")
          else
            c[2].succ!
            c[0..2].join(".") + "-rc0"
          end
          puts "version=#{next_version}"
          EOF

      - name: Bump version to avoid confusion with code older than the tag
        if: inputs.bump_to_rc_after_release
        run: |
          bundle exec rake vox:version:bump:full[${{ steps.future_version.outputs.version }}]

      - name: Commit version bump
        if: inputs.bump_to_rc_after_release
        uses: stefanzweifel/git-auto-commit-action@v7
        with:
          commit_user_name: ${{ env.GIT_COMMITTER_NAME }}
          commit_user_email: ${{ env.GIT_COMMITTER_EMAIL }}
          commit_author: '${{ env.GIT_AUTHOR_NAME }} <${{ env.GIT_AUTHOR_EMAIL }}>'
          commit_message: "Bump version to ${{ steps.future_version.outputs.version }}"