release.yml

name: Publish Package to npmjs
# Name each run for its trigger, so manual canary builds are distinguishable
# from real releases in the Actions list.
run-name: "${{ github.event_name == 'workflow_dispatch' && format('Canary build - {0}', github.ref_name) || format('Release {0}', github.event.release.tag_name) }}"
on:
  release:
    types: [published]
  # Manual canary builds: dispatch this workflow on a branch to publish an
  # experimental build of that branch. It lives here (not a separate workflow) so
  # it authenticates via the npm OIDC trusted publisher — npm allows only ONE
  # trusted publisher (repo + workflow file) per package, and that slot is release.yml.
  workflow_dispatch:
    inputs:
      tag:
        description: npm dist-tag for the canary build
        required: false
        default: experimental
jobs:
  validate-tag:
    # Release-event path only. A manual dispatch runs the `canary` job below; the
    # other release jobs cascade-skip on dispatch via their `needs: validate-tag`.
    if: ${{ github.event_name == 'release' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions-ecosystem/action-regex-match@v2
        id: tag-match
        with:
          text: ${{ github.event.release.tag_name }}
          regex: '^\d+\.\d+\.\d+$'
      - run: echo "Please create tag for release with format like 4.0.1" && exit 1
        if: ${{ steps.tag-match.outputs.match == '' }}
      # Old create-checkly versions still look for the tag with a `v` prefix.
      # We can automatically push the necessary tag to keep those working.
      - name: Create tag for old create-checkly versions
        uses: actions/github-script@v6
        with:
          script: |
            github.rest.git.createRef({
              owner: context.repo.owner,
              repo: context.repo.repo,
              ref: 'refs/tags/v${{ github.event.release.tag_name }}',
              sha: context.sha
            })

  # Build package and publish a prerelease
  prerelease:
    needs: validate-tag
    permissions:
      id-token: write
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: pnpm/action-setup@v5
        with:
          version: 10
      - uses: actions/setup-node@v4
        with:
          node-version: '24.x'
          cache: "pnpm"
      # Ensure that the README is published with the package
      - run: rm -f packages/cli/README.md && cp README.md packages/cli
      - run: pnpm install --frozen-lockfile
      - name: Add SHORT_SHA env property with commit short sha
        run: echo "SHORT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
      - name: Set version and publish prerelease for 'cli' package
        run: |
          pnpm version ${{ github.event.release.tag_name }}-prerelease-${{ env.SHORT_SHA }} --no-git-tag-version
          pnpm pack
          npm publish checkly-*.tgz --provenance --tag prerelease
        working-directory: packages/cli
      - name: Set version and publish prerelease for 'create-cli' package
        run: |
          pnpm version ${{ github.event.release.tag_name }}-prerelease-${{ env.SHORT_SHA }} --no-git-tag-version
          pnpm pack
          npm publish create-checkly-*.tgz --provenance --tag prerelease
        working-directory: packages/create-cli
      - name: Save LLM rules as an artifact
        uses: actions/upload-artifact@v4
        with:
          name: llm-rules-prerelease
          if-no-files-found: error
          path: packages/cli/dist/ai-context/*
      # Slack failure alert
      - name: Slack Failure Notification
        if: ${{ failure() }}
        uses: rtCamp/action-slack-notify@v2
        env:
          SLACK_USERNAME: Checkly Github Bot
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
          SLACK_CHANNEL: cli
          SLACK_ICON: https://github.com/checkly.png?size=48
          SLACK_COLOR: ${{ job.status }}
          SLACK_TITLE: ':red_circle: NPM prerelease failed'
          SLACK_MESSAGE: by ${{ github.actor }}
          SLACK_FOOTER: ''
      # Slack success alert
      - name: Slack Success Notification
        if: ${{ success() }}
        uses: rtCamp/action-slack-notify@v2
        env:
          SLACK_USERNAME: Checkly Github Bot
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
          SLACK_CHANNEL: cli
          SLACK_ICON: https://github.com/checkly.png?size=48
          SLACK_COLOR: ${{ job.status }}
          SLACK_TITLE: ':white_check_mark: NPM prerelease succeeded'
          SLACK_MESSAGE: by ${{ github.actor }}
          SLACK_FOOTER: ''
  # Publish package to NPM
  release:
    runs-on: ubuntu-latest
    environment: production
    needs: prerelease
    permissions:
      id-token: write
    steps:
      - uses: actions/checkout@v3
        with:
          ref: main
      - uses: pnpm/action-setup@v5
        with:
          version: 10
      - uses: actions/setup-node@v4
        with:
          node-version: '24.x'
          cache: "pnpm"
      # Ensure that the README is published with the package
      - run: rm -f packages/cli/README.md && cp README.md packages/cli
      - run: pnpm install --frozen-lockfile
      - name: Set version and publish 'cli' package
        run: |
          pnpm version ${{ github.event.release.tag_name }} --no-git-tag-version
          pnpm pack
          npm publish checkly-*.tgz --provenance
        working-directory: packages/cli
      - name: Set version and publish 'create-cli' package
        run: |
          pnpm version ${{ github.event.release.tag_name }} --no-git-tag-version
          pnpm pack
          npm publish create-checkly-*.tgz --provenance
        working-directory: packages/create-cli
      - name: Save LLM rules as an artifact
        uses: actions/upload-artifact@v4
        with:
          name: llm-rules-release
          if-no-files-found: error
          path: packages/cli/dist/ai-context/*
      # Slack failure alert
      - name: Slack Failure Notification
        if: ${{ failure() }}
        uses: rtCamp/action-slack-notify@v2
        env:
          SLACK_USERNAME: Checkly Github Bot
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
          SLACK_CHANNEL: cli
          SLACK_ICON: https://github.com/checkly.png?size=48
          SLACK_COLOR: ${{ job.status }}
          SLACK_TITLE: ':red_circle: NPM publish failed'
          SLACK_MESSAGE: by ${{ github.actor }}
          SLACK_FOOTER: ''
      # Slack success alert
      - name: Slack Success Notification
        if: ${{ success() }}
        uses: rtCamp/action-slack-notify@v2
        env:
          SLACK_USERNAME: Checkly Github Bot
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
          SLACK_CHANNEL: cli
          SLACK_ICON: https://github.com/checkly.png?size=48
          SLACK_COLOR: ${{ job.status }}
          SLACK_TITLE: ':white_check_mark: NPM publish succeeded'
          SLACK_MESSAGE: by ${{ github.actor }}
          SLACK_FOOTER: ''
  # Mark the GitHub Release as latest if it's the highest version
  finalize-release:
    runs-on: ubuntu-latest
    needs: release
    permissions:
      contents: write
    steps:
      - name: Mark release as latest if version is highest
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          CURRENT_LATEST=$(gh release list --repo ${{ github.repository }} --json tagName,isLatest --jq '.[] | select(.isLatest) | .tagName')
          NEW_TAG=${{ github.event.release.tag_name }}
          if [ -z "$CURRENT_LATEST" ] || [ "$(printf '%s\n%s' "$CURRENT_LATEST" "$NEW_TAG" | sort -V | tail -n1)" = "$NEW_TAG" ]; then
            echo "Marking $NEW_TAG as latest (current latest: ${CURRENT_LATEST:-none})"
            gh release edit "$NEW_TAG" --latest --repo ${{ github.repository }}
          else
            echo "Skipping: $NEW_TAG is not newer than current latest $CURRENT_LATEST"
          fi

  # Manual canary: dispatch this workflow on a branch to publish an experimental
  # build of that branch. Authenticates via the SAME npm OIDC trusted publisher as
  # the release jobs above (id-token + --provenance, no token). Trigger with
  # `gh workflow run release.yml --ref <branch>` (optionally `-f tag=<dist-tag>`).
  # Replaces the old build-label release-canary.yml, whose classic NPM_TOKEN was
  # retired when the package moved to OIDC.
  canary:
    if: ${{ github.event_name == 'workflow_dispatch' }}
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    steps:
      - uses: actions/checkout@v3
      - uses: pnpm/action-setup@v5
        with:
          version: 10
      - uses: actions/setup-node@v4
        with:
          node-version: '24.x'
          cache: "pnpm"
      # Ensure that the README is published with the package
      - run: rm -f packages/cli/README.md && cp README.md packages/cli
      - run: echo "CANARY_VERSION=0.0.0-canary.$(git rev-parse --short HEAD)" >> $GITHUB_ENV
      - run: pnpm install --frozen-lockfile
      - name: Set version, pack, and publish (OIDC trusted publishing)
        run: |
          pnpm version ${{ env.CANARY_VERSION }} --no-git-tag-version
          pnpm pack
          npm publish checkly-*.tgz --provenance --tag '${{ inputs.tag }}'
        working-directory: packages/cli
      - name: Publish summary
        run: |
          {
            echo "Published \`checkly@${{ env.CANARY_VERSION }}\` (dist-tag: \`${{ inputs.tag }}\`)"
            echo '```'
            echo "npm install checkly@${{ env.CANARY_VERSION }}"
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"