release.yml

name: Release
run-name: >-
  ${{
    github.event_name == 'issue_comment'
      && format('[Snapshot] Release by {0}', github.actor)
    || contains(github.event.head_commit.message, 'Version packages')
      && format('[Production] Release from {0}', github.ref_name)
    || format('[Canary] Release from {0}', github.ref_name)
  }}

on:
  push:
    branches:
      - main
  issue_comment:
    types: [created]

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'issue_comment' && format('issue-{0}-{1}', github.event.issue.number, github.actor) || github.ref }}
  cancel-in-progress: true

jobs:
  release:
    name: Release
    if: ${{ github.event_name == 'push' && github.repository == 'clerk/javascript' }}
    runs-on: ${{ vars.RUNNER_NORMAL || 'ubuntu-latest' }}
    timeout-minutes: ${{ vars.TIMEOUT_MINUTES_NORMAL && fromJSON(vars.TIMEOUT_MINUTES_NORMAL) || 10 }}

    permissions:
      contents: write
      id-token: write
      packages: write
      pull-requests: write
      issues: read
      statuses: write
      checks: write

    outputs:
      # Exposed so the dependent `recover` job can gate on the same
      # condition the old inline recovery step used.
      changesets_conclusion: ${{ steps.changesets.conclusion }}

    steps:
      - name: Echo github context
        run: echo "$GITHUB_CONTEXT"
        env:
          GITHUB_CONTEXT: ${{ toJson(github) }}

      - name: Checkout repo
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          show-progress: false
          # Use the PAT so pushes from `changesets/action` are authored by
          # clerk-cookie. With the default GITHUB_TOKEN, GitHub suppresses
          # the resulting `synchronize` events and CI never runs on Release
          # PR updates, forcing a manual close/reopen to re-trigger.
          token: ${{ secrets.CLERK_COOKIE_PAT }}

      # Guard against races where this run is on a SHA that has been
      # superseded by a newer commit on main (e.g. two Version-packages
      # PRs merging back-to-back, or a manual re-run of an older release
      # after main has moved). Cancel the run before build/publish so we
      # don't waste CI or trigger spurious failure alerts. Cancelling
      # (rather than failing) matches the status that
      # `concurrency: cancel-in-progress` would produce.
      - name: Ensure HEAD is origin/main
        env:
          GH_TOKEN: ${{ secrets.CLERK_COOKIE_PAT }}
        run: |
          git fetch origin main --quiet
          local_sha=$(git rev-parse HEAD)
          remote_sha=$(git rev-parse origin/main)
          if [ "$local_sha" != "$remote_sha" ]; then
            echo "::notice::Cancelling release: HEAD ($local_sha) has been superseded by origin/main ($remote_sha). The newer push will handle this release."
            gh run cancel ${{ github.run_id }} --repo ${{ github.repository }}
            # Cancellation is async; sleep so the runner is interrupted
            # before subsequent steps execute. exit 1 as fallback if
            # cancellation does not take effect within the window.
            sleep 30
            exit 1
          fi

      - name: Setup
        id: config
        uses: ./.github/actions/init
        with:
          cache-enabled: false # OIDC publish job; do not restore poisonable cache state.
          turbo-enabled: false # Release uses --force, so turbo cache is not needed
          turbo-team: ""
          turbo-token: ""

      - name: Upgrade npm for trusted publishing
        run: npx npm@11 install -g npm@11

      - name: Build release
        run: pnpm turbo build $TURBO_ARGS --force

      - name: Create Release PR
        id: changesets
        uses: changesets/action@v1
        with:
          commit: "ci(repo): Version packages"
          title: "ci(repo): Version packages"
          publish: pnpm release
          # Workaround for https://github.com/changesets/changesets/issues/421
          version: pnpm version-packages
        env:
          GITHUB_TOKEN: ${{ secrets.CLERK_COOKIE_PAT }}
          HUSKY: "0"
          NPM_CONFIG_PROVENANCE: true

      - name: Trigger workflows on related repos
        if: steps.changesets.outputs.published == 'true'
        continue-on-error: true
        uses: actions/github-script@v7
        with:
          result-encoding: string
          retries: 3
          retry-exempt-status-codes: 400,401
          github-token: ${{ secrets.CLERK_COOKIE_PAT }}
          script: |
            const preMode = require("fs").existsSync("./.changeset/pre.json");
            if (!preMode) {
              const clerkjsVersion = require('./packages/clerk-js/package.json').version;
              const clerkUiVersion = require('./packages/ui/package.json').version;
              const nextjsVersion = require('./packages/nextjs/package.json').version;

              // NOTE: Keep in sync with the `targets` array in `release-recovery.yml`.
              const targets = [
                { repo: 'sdk-infra-workers', workflow_id: 'update-pkg-versions.yml', inputs: { clerkjsVersion, clerkUiVersion } },
                { repo: 'dashboard', workflow_id: 'prepare-nextjs-sdk-update.yml', inputs: { version: nextjsVersion } },
                { repo: 'clerk-docs', workflow_id: 'typedoc.yml' },
              ];
              const results = await Promise.allSettled(
                targets.map(t => github.rest.actions.createWorkflowDispatch({ owner: 'clerk', ref: 'main', ...t }))
              );
              const failures = results
                .map((r, i) => r.status === 'rejected' ? { target: targets[i], reason: r.reason } : null)
                .filter(Boolean);
              if (failures.length) {
                failures.forEach(f => core.error(`Dispatch to ${f.target.repo}/${f.target.workflow_id} failed: ${f.reason?.message ?? f.reason}`));
                core.setFailed(`${failures.length} downstream dispatch(es) failed`);
              }
            } else{
              core.warning("Changeset in pre-mode should not prepare a ClerkJS production release")
            }

      - name: Generate notification payload
        id: notification
        if: steps.changesets.outputs.published == 'true'
        run: payload=$(node scripts/notify.mjs '${{ steps.changesets.outputs.publishedPackages }}' '${{ github.actor }}') && echo ::set-output name=payload::${payload//$'\n'/'%0A'}

      - name: Send commit log to Slack
        id: slack
        if: steps.changesets.outputs.published == 'true'
        uses: slackapi/slack-github-action@v1.24.0
        with:
          payload: ${{ steps.notification.outputs.payload }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CHANGELOG_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

      - name: Notify Slack on failure
        if: ${{ always() && steps.changesets.outcome == 'failure' }}
        uses: slackapi/slack-github-action@v1.24.0
        with:
          payload: |
            {
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "*:red_circle: Stable release failed*\n*Repo:* `${{ github.repository }}`\n*Workflow:* `${{ github.workflow }}`\n*Commit:* `${{ github.sha }}`\n*Triggered by:* `${{ github.actor }}`\n*Run:* <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View logs>"
                  }
                }
              ]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SDK_SLACKER_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

  # If the changesets step in `release` failed, re-fire the downstream
  # dispatches via the shared reusable workflow. The workflow's own
  # script is idempotent (checks npm before dispatching) and is also
  # the manual entry point via workflow_dispatch.
  recover:
    name: Recover downstream notifications
    needs: release
    if: ${{ always() && needs.release.outputs.changesets_conclusion == 'failure' }}
    uses: ./.github/workflows/release-recovery.yml
    secrets: inherit

  canary-release:
    name: Canary release
    if: ${{ github.event_name == 'push' && github.repository == 'clerk/javascript' }}
    runs-on: ${{ vars.RUNNER_NORMAL || 'ubuntu-latest' }}
    timeout-minutes: ${{ vars.TIMEOUT_MINUTES_NORMAL && fromJSON(vars.TIMEOUT_MINUTES_NORMAL) || 10 }}
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
          fetch-tags: false
          filter: 'blob:none'

      - name: Setup
        id: config
        uses: ./.github/actions/init
        with:
          cache-enabled: false # OIDC publish job; do not restore poisonable cache state.
          turbo-enabled: false # Remote cache disabled in OIDC publish path.
          turbo-team: ""
          turbo-token: ""

      - name: Upgrade npm for trusted publishing
        run: npx npm@11 install -g npm@11

      - name: Version packages for canary
        id: version-packages
        run: pnpm version-packages:canary | tail -1 >> "$GITHUB_OUTPUT"

      - name: Build release
        if: steps.version-packages.outputs.success == '1'
        run: pnpm turbo build $TURBO_ARGS

      - name: Canary release
        id: publish
        if: steps.version-packages.outputs.success == '1'
        run: pnpm release:canary
        env:
          NPM_CONFIG_PROVENANCE: true

      - name: Trigger workflows on related repos
        if: steps.publish.outcome == 'success'
        continue-on-error: true
        uses: actions/github-script@v7
        with:
          result-encoding: string
          retries: 3
          retry-exempt-status-codes: 400,401
          github-token: ${{ secrets.CLERK_COOKIE_PAT }}
          script: |
            const clerkjsVersion = require('./packages/clerk-js/package.json').version;
            const clerkUiVersion = require('./packages/ui/package.json').version;
            const nextjsVersion = require('./packages/nextjs/package.json').version;

            const targets = [
              { repo: 'sdk-infra-workers', workflow_id: 'update-pkg-versions.yml', inputs: { clerkjsVersion, clerkUiVersion, sourceCommit: context.sha } },
            ];

            if (nextjsVersion.includes('canary')) {
              console.log('clerk/nextjs changed, will notify clerk/accounts');
              targets.push(
                { repo: 'accounts', workflow_id: 'release-staging.yml', inputs: { version: nextjsVersion } },
              );
            }

            const results = await Promise.allSettled(
              targets.map(t => github.rest.actions.createWorkflowDispatch({ owner: 'clerk', ref: 'main', ...t }))
            );
            const failures = results
              .map((r, i) => r.status === 'rejected' ? { target: targets[i], reason: r.reason } : null)
              .filter(Boolean);
            if (failures.length) {
              failures.forEach(f => core.error(`Dispatch to ${f.target.repo}/${f.target.workflow_id} failed: ${f.reason?.message ?? f.reason}`));
              core.setFailed(`${failures.length} downstream dispatch(es) failed`);
            }

      - name: Notify Slack on failure
        if: ${{ always() && steps.publish.outcome == 'failure' }}
        uses: slackapi/slack-github-action@v1.24.0
        with:
          payload: |
            {
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "*:red_circle: Canary release failed*\n*Repo:* `${{ github.repository }}`\n*Workflow:* `${{ github.workflow }}`\n*Commit:* `${{ github.sha }}`\n*Triggered by:* `${{ github.actor }}`\n*Run:* <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View logs>"
                  }
                }
              ]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SDK_SLACKER_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

  snapshot-release:
    name: Snapshot release
    if: ${{ github.event_name == 'issue_comment' && startsWith(github.event.comment.body, '!snapshot') && github.repository == 'clerk/javascript' && github.event.issue.pull_request }}
    runs-on: ${{ vars.RUNNER_LARGE || 'ubuntu-latest-l' }}
    timeout-minutes: ${{ vars.TIMEOUT_MINUTES_NORMAL && fromJSON(vars.TIMEOUT_MINUTES_NORMAL) || 10 }}

    permissions:
      contents: read
      id-token: write
      pull-requests: write

    steps:
      - name: Limit action to Clerk members
        uses: actions/github-script@v7
        with:
          result-encoding: string
          retries: 3
          retry-exempt-status-codes: 400,401
          github-token: ${{ secrets.CLERK_COOKIE_PAT }}
          script: |
            try {
              const { data } = await github.rest.orgs.getMembershipForUser({
                org: 'clerk',
                username: context.actor
              });
              if (data.state !== 'active') {
                core.setFailed(`@${context.actor} is not an active member of the Clerk organization`);
              }
            } catch (e) {
              core.setFailed(`@${context.actor} is not a member of the Clerk organization`);
            }

      - name: Validate PR source and freshness
        uses: actions/github-script@v7
        with:
          result-encoding: string
          retries: 3
          retry-exempt-status-codes: 400,401
          script: |
            const { data: pr } = await github.rest.pulls.get({
              owner: 'clerk',
              repo: 'javascript',
              pull_number: context.issue.number,
            });

            if (pr.head.repo.full_name !== pr.base.repo.full_name) {
              core.setFailed('Snapshots are restricted to branches within clerk/javascript.');
              return;
            }

            const commentCreated = new Date(context.payload.comment.created_at);
            const prLastUpdated = new Date(pr.updated_at);

            if (prLastUpdated > commentCreated) {
              core.setFailed("The PR has been updated since !snapshot was initiated. Please review the changes and re-run the !snapshot command.");
            }

      - name: Checkout repo
        uses: actions/checkout@v4
        with:
          ref: refs/pull/${{ github.event.issue.number }}/head
          persist-credentials: false
          fetch-depth: 1
          fetch-tags: false
          filter: 'blob:none'

      - name: Setup
        id: config
        uses: ./.github/actions/init
        with:
          cache-enabled: false # OIDC publish job; do not restore poisonable cache state.
          turbo-enabled: false # Remote cache disabled in OIDC publish path.
          turbo-team: ""
          turbo-token: ""

      - name: Upgrade npm for trusted publishing
        run: npx npm@11 install -g npm@11

      - name: Extract snapshot name
        id: extract-snapshot-name
        uses: actions/github-script@v7
        with:
          script: |
            const match = context.payload.comment.body.match(/!snapshot (.*)/)
            const name = match && match[1] || '';
            const isKebabCase = name.match(/^[a-z]+(-[a-z]+)*$/)
            if(name && !isKebabCase) {
              core.setFailed(`Invalid snapshot name: ${name}`);
            }
            core.setOutput('name', name);

      - name: Version packages for snapshot
        id: version-packages
        run: pnpm version-packages:snapshot ${{ steps.extract-snapshot-name.outputs.name }} | tail -1 >> "$GITHUB_OUTPUT"

      - name: Build release
        if: steps.version-packages.outputs.success == '1'
        run: pnpm turbo build $TURBO_ARGS

      - name: Snapshot release
        if: steps.version-packages.outputs.success == '1'
        run: pnpm release:snapshot
        env:
          NPM_CONFIG_PROVENANCE: true

      - name: Package info
        if: steps.version-packages.outputs.success == '1'
        id: package-info
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require("fs");
            const files = await (await glob.create("./packages/*/package.json")).glob();
            const descriptors = files
              .map((file) => {
                const { name, version } = JSON.parse(fs.readFileSync(file, "utf8"));
                return { name, version };
              })
              .filter(({ version }) => version.includes("-${{ steps.extract-snapshot-name.outputs.name }}"));

            let table = `| Package | Version |\n| --- | --- |\n`;
            descriptors.forEach(({ name, version }) => {
              table += `| ${name} | ${version} |\n`;
            });
            const snippets = descriptors
              .map(
                ({ name, version }) =>
                  `\`${name}\`\n\`\`\`sh\nnpm i ${name}@${version} --save-exact\n\`\`\``
              )
              .join("\n");
            core.setOutput("table", table);
            core.setOutput("snippets", snippets);

      - name: Update Comment
        if: steps.version-packages.outputs.success == '1'
        uses: peter-evans/create-or-update-comment@v3.0.0
        with:
          comment-id: ${{ github.event.comment.id }}
          reactions: heart

      - name: Minimize previous snapshot comments
        if: steps.version-packages.outputs.success == '1'
        uses: actions/github-script@v7
        with:
          script: |
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              per_page: 100,
            });

            const snapshotComments = comments.filter(
              (comment) =>
                comment.body?.includes('the snapshot version command generated the following package versions')
            );

            for (const comment of snapshotComments) {
              await github.graphql(`
                mutation MinimizeComment($id: ID!) {
                  minimizeComment(input: { subjectId: $id, classifier: OUTDATED }) {
                    minimizedComment {
                      isMinimized
                    }
                  }
                }
              `, { id: comment.node_id });
            }

      - name: Create snapshot release comment
        if: steps.version-packages.outputs.success == '1'
        uses: peter-evans/create-or-update-comment@v3.0.0
        with:
          issue-number: ${{ github.event.issue.number }}
          body: |
            Hey @${{ github.event.comment.user.login }} - the snapshot version command generated the following package versions:
            ${{ steps.package-info.outputs.table }}
            Tip: Use the snippet copy button below to quickly install the required packages.
            ${{ steps.package-info.outputs.snippets }}

  # We're running the CI workflow (where node v20 modules are cached) in
  # merge_group and not on main, we need to explicitly cache node_modules here so
  # that follow-on branches can use the cached version of node_modules rather
  # than recreating them every time.
  cache-for-alternate-node-versions:
    name: Cache for Alternate Node Versions
    if: ${{ github.event_name == 'push' }}
    runs-on: ${{ vars.RUNNER_NORMAL || 'ubuntu-latest' }}
    timeout-minutes: ${{ vars.TIMEOUT_MINUTES_NORMAL && fromJSON(vars.TIMEOUT_MINUTES_NORMAL) || 10 }}
    continue-on-error: true

    permissions:
      contents: read

    strategy:
      matrix:
        version: [24] # NOTE: 20 is cached in the main release workflow

    steps:
      - name: Checkout Repo
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
          fetch-tags: false
          filter: "blob:none"
          show-progress: false

      - name: Cache node_modules (Node v${{ matrix.version }})
        uses: ./.github/actions/init
        with:
          cache-enabled: true
          node-version: ${{ matrix.version }}
          turbo-enabled: false
          turbo-team: ""
          turbo-token: ""