release-please.yml

name: Release

on:
  push:
    branches: [main]

permissions:
  contents: write
  pull-requests: write
  id-token: write # required for npm publish --provenance

concurrency:
  group: release-please
  cancel-in-progress: false

jobs:
  release-please:
    name: Release Please
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: googleapis/release-please-action@v5
        id: release
        with:
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json

      # While a release PR is open, rebuild the embed bundle and commit the
      # fresh artifacts onto the PR branch, so the tagged release commit carries
      # the exact bytes jsDelivr serves at gh@<major>/cdn/.
      - name: Checkout release PR branch
        if: ${{ steps.release.outputs.pr }}
        uses: actions/checkout@v7
        with:
          ref: ${{ fromJSON(steps.release.outputs.pr).headBranchName }}

      - name: Setup pnpm
        if: ${{ steps.release.outputs.pr }}
        uses: pnpm/action-setup@v6
        with:
          version: 9

      - name: Setup Node
        if: ${{ steps.release.outputs.pr }}
        uses: actions/setup-node@v6
        with:
          node-version: 20
          cache: pnpm
          cache-dependency-path: widget/pnpm-lock.yaml

      - name: Rebuild and commit cdn/ bundle
        if: ${{ steps.release.outputs.pr }}
        env:
          PR_BRANCH: ${{ steps.release.outputs.pr && fromJSON(steps.release.outputs.pr).headBranchName || '' }}
        run: |
          pnpm --dir widget install --frozen-lockfile
          pnpm --dir widget run build:embed
          mkdir -p cdn
          cp widget/dist/claudius.iife.js cdn/claudius.iife.js
          cp widget/dist/claudius.css cdn/claudius.css
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          if ! git diff --quiet -- cdn/; then
            git add cdn/claudius.iife.js cdn/claudius.css
            git commit -m "chore: rebuild cdn bundle for release"
            git push origin "HEAD:${PR_BRANCH}"
          fi

      # On merge, attach the same bundle to the GitHub Release.
      - name: Upload bundle to release
        if: ${{ steps.release.outputs.release_created }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload "${{ steps.release.outputs.tag_name }}" \
            cdn/claudius.iife.js cdn/claudius.css --clobber

      # ---------------------------------------------------------------------
      # Publish to npm via npm Trusted Publishing (OIDC). Tokenless: there is no
      # NPM_TOKEN secret. Each published package (claudius-chat-widget and
      # create-claudius) has a trusted publisher configured on npmjs.com, bound
      # to BOTH:
      #   repo:     PMDevSolutions/Claudius
      #   workflow: release-please.yml   (the filename of THIS workflow)
      # The job-level "id-token: write" permission lets npm exchange a GitHub
      # OIDC token for a short-lived publish token. Provenance is automatic.
      #
      # IMPORTANT: the trusted-publisher binding is keyed on this workflow's
      # FILENAME. Renaming this file, or running "npm publish" from a different
      # workflow, breaks publishing until each package's trusted publisher is
      # updated on npmjs.com to match the new filename.
      #
      # OIDC requires npm >= 11.5.1, newer than the npm bundled with Node 22, so
      # the steps below upgrade and verify npm first. Publishing runs against the
      # default checkout (main at the released commit), which carries the version
      # release-please just bumped.
      # ---------------------------------------------------------------------
      - name: Setup pnpm (npm publish)
        if: ${{ steps.release.outputs.release_created }}
        uses: pnpm/action-setup@v6
        with:
          version: 9

      - name: Setup Node (npm publish)
        if: ${{ steps.release.outputs.release_created }}
        uses: actions/setup-node@v6
        with:
          node-version: 22
          # registry-url makes setup-node write the registry that OIDC mints its
          # short-lived token against (required for trusted publishing). The
          # "Sanitize npm config" step below removes the legacy always-auth key
          # and placeholder _authToken that setup-node also writes.
          registry-url: https://registry.npmjs.org
          cache: pnpm
          cache-dependency-path: widget/pnpm-lock.yaml

      # setup-node's generated .npmrc (path exported as NPM_CONFIG_USERCONFIG)
      # carries a deprecated "always-auth" key (npm >= 11 warns: Unknown user
      # config "always-auth") and a placeholder _authToken that expands to empty.
      # Strip both so npm authenticates via OIDC instead of a bogus token; keep
      # the registry line so OIDC knows which registry to target.
      - name: Sanitize npm config for OIDC
        if: ${{ steps.release.outputs.release_created }}
        run: |
          for f in "${NPM_CONFIG_USERCONFIG:-}" "$HOME/.npmrc"; do
            [ -n "$f" ] && [ -f "$f" ] || continue
            sed -i '/^always-auth=/d; /_authToken=/d' "$f"
            echo "Sanitized $f:"
            cat "$f"
          done

      # Trusted Publishing (OIDC) requires npm >= 11.5.1, newer than Node 22's
      # bundled npm. Pin to npm 11 (not @latest) for reproducible runs, assert
      # the version, and prepend the freshly installed npm's bin dir to PATH so
      # the publish steps use it instead of Node's bundled npm.
      - name: Upgrade and verify npm for trusted publishing
        if: ${{ steps.release.outputs.release_created }}
        run: |
          npm install -g npm@^11
          NPM_GLOBAL_BIN="$(npm prefix -g)/bin"
          echo "$NPM_GLOBAL_BIN" >> "$GITHUB_PATH"
          NPM_VERSION="$("$NPM_GLOBAL_BIN/npm" --version)"
          echo "Resolved npm $NPM_VERSION from $NPM_GLOBAL_BIN"
          if [ "$(printf '%s\n' "11.5.1" "$NPM_VERSION" | sort -V | head -n1)" != "11.5.1" ]; then
            echo "::error::npm $NPM_VERSION is older than 11.5.1; trusted publishing (OIDC) requires >= 11.5.1" >&2
            exit 1
          fi

      - name: Build and publish widget
        if: ${{ steps.release.outputs.release_created }}
        working-directory: widget
        run: |
          pnpm install --frozen-lockfile
          pnpm build
          npm publish --provenance --access public

      - name: Build and publish create-claudius
        if: ${{ steps.release.outputs.release_created }}
        working-directory: create-claudius
        run: |
          pnpm install --frozen-lockfile
          pnpm build
          npm publish --provenance --access public