release.yml

name: Release CLI

on:
  push:
    tags:
      - "cli-v*"

permissions:
  contents: write
  id-token: write

concurrency:
  group: release-cli
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Abort if tag is not on main
        run: |
          set -euo pipefail
          git fetch origin main
          if git merge-base --is-ancestor "${GITHUB_SHA}" "origin/main"; then
            echo "Tag commit ${GITHUB_SHA} is reachable from main."
          else
            echo "::error::Tag commit ${GITHUB_SHA} is not on main. Aborting."
            exit 1
          fi

      - name: Extract version from tag
        id: version
        run: |
          VERSION="${GITHUB_REF_NAME#cli-v}"
          if ! echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$'; then
            echo "::error::Could not extract a valid version from tag '${GITHUB_REF_NAME}'"
            exit 1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Version: $VERSION"

      - name: Validate version matches package.json
        working-directory: cli
        env:
          TAG_VERSION: ${{ steps.version.outputs.version }}
        run: |
          PKG_VERSION=$(node -p "require('./package.json').version")
          if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then
            echo "::error::Tag version ($TAG_VERSION) does not match package.json ($PKG_VERSION)"
            exit 1
          fi

      # --- Docker build ---

      - name: Set up Docker
        uses: docker/setup-docker-action@efe9e3891a4f7307e689f2100b33a155b900a608 # v4.5.0

      - name: Build CLI tarball using Docker
        working-directory: cli
        env:
          COMMIT_HASH: ${{ github.sha }}
          MOPS_VERSION: ${{ steps.version.outputs.version }}
        run: |
          docker build . \
            --build-arg COMMIT_HASH="$COMMIT_HASH" \
            --build-arg MOPS_VERSION="$MOPS_VERSION" \
            -t mops

      - name: Extract tarball from container
        working-directory: cli
        run: |
          cid=$(docker create mops)
          mkdir -p bundle
          docker cp "$cid:/mops/cli/bundle/cli.tgz" ./bundle/cli.tgz
          docker rm "$cid"

      - name: Compute SHA256
        id: hash
        working-directory: cli
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          HASH=$(sha256sum bundle/cli.tgz | awk '{print $1}')
          echo "hash=$HASH" >> "$GITHUB_OUTPUT"
          echo "### CLI Release v${VERSION}" >> "$GITHUB_STEP_SUMMARY"
          echo "**SHA256:** \`$HASH\`" >> "$GITHUB_STEP_SUMMARY"

      # --- npm publish ---

      - name: Set up Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: 24
          registry-url: "https://registry.npmjs.org"

      - uses: ./.github/actions/cache-rust-wasm

      - name: Install dependencies
        working-directory: cli
        run: npm ci

      - name: Extract changelog
        working-directory: cli
        env:
          VERSION: ${{ steps.version.outputs.version }}
          BUILD_HASH: ${{ steps.hash.outputs.hash }}
          COMMIT_HASH: ${{ github.sha }}
        run: |
          ESCAPED=$(echo "$VERSION" | sed 's/\./\\./g')
          awk "/^##? ${ESCAPED}$/{found=1; next} found && /^##? [0-9]/{exit} found && /^##? Next/{exit} found" \
            CHANGELOG.md > /tmp/release-notes.md

          if [ ! -s /tmp/release-notes.md ]; then
            echo "::error::No changelog entry found for version ${VERSION}"
            exit 1
          fi

          {
            echo ""
            echo "---"
            echo "**SHA256:** \`${BUILD_HASH}\`"
            echo ""
            echo "**Verify build:**"
            echo '```bash'
            echo "cd cli"
            echo "docker build . --build-arg COMMIT_HASH=${COMMIT_HASH} --build-arg MOPS_VERSION=${VERSION} -t mops"
            echo "docker run --rm --env SHASUM=${BUILD_HASH} mops"
            echo '```'
          } >> /tmp/release-notes.md

      - name: Publish to npm
        working-directory: cli
        run: npm publish --provenance --ignore-scripts

      # --- GitHub Release ---

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          gh release create "$TAG" \
            cli/bundle/cli.tgz#cli.tgz \
            --title "CLI v${VERSION}" \
            --notes-file /tmp/release-notes.md

      # --- On-chain release artifacts ---

      - name: Generate on-chain release artifacts
        working-directory: cli
        env:
          SKIP_BUILD: "1"
          COMMIT_HASH: ${{ github.sha }}
        run: npx tsx release-cli.ts

      # --- Canister deployments ---

      - uses: dfinity/setup-dfx@e50c04f104ee4285ec010f10609483cf41e4d365 # main

      - name: Import mops identity
        env:
          MOPS_IDENTITY_PEM: ${{ secrets.MOPS_IDENTITY_PEM }}
        run: |
          echo "$MOPS_IDENTITY_PEM" > /tmp/mops.pem
          trap 'rm -f /tmp/mops.pem' EXIT
          dfx identity import mops /tmp/mops.pem --storage-mode plaintext

      - name: Install cli-releases dependencies
        working-directory: cli-releases
        run: npm ci

      - name: Deploy CLI canister
        env:
          DFX_WARNING: -mainnet_plaintext_identity
        run: |
          for i in 1 2 3; do
            dfx deploy --network ic --no-wallet cli --identity mops && exit 0
            echo "::warning::CLI canister deploy attempt $i/3 failed"
            [ "$i" -lt 3 ] && sleep 30
          done
          exit 1

      - name: Install docs dependencies
        working-directory: docs
        run: npm ci

      - name: Deploy docs canister
        env:
          DFX_WARNING: -mainnet_plaintext_identity
        run: |
          for i in 1 2 3; do
            dfx deploy --network ic --no-wallet docs --identity mops && exit 0
            echo "::warning::Docs canister deploy attempt $i/3 failed"
            [ "$i" -lt 3 ] && sleep 30
          done
          exit 1

      # --- Commit release artifacts ---

      - name: Create GitHub App Token
        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3
        id: app-token
        with:
          app-id: ${{ vars.GENERIC_CI_RW_APP_ID }}
          private-key: ${{ secrets.GENERIC_CI_RW_APP_PRIVATE_KEY }}

      - name: Create artifacts PR
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git checkout -b ci/release-${VERSION}-artifacts
          git add cli-releases/
          git commit -m "cli-releases: v${VERSION} artifacts"
          git push -u origin ci/release-${VERSION}-artifacts
          gh pr create \
            --title "cli-releases: v${VERSION} artifacts" \
            --body "Release artifacts generated by CI for CLI v${VERSION}." \
            --base main
          gh pr merge --auto --squash