release-please.yaml

name: Release Please

# Maintains the single release PR (VERSION bump + Communique-written
# CHANGELOG section) and, when that PR merges, creates the tag + GitHub Release.
# The stock release-please action cannot register a custom changelog generator,
# so this workflow runs scripts/release-please-runner.js against the
# release-please library and registers Communique there.
on:
  workflow_dispatch:
  push:
    branches:
      - main

concurrency:
  group: release-please-main
  cancel-in-progress: false

permissions:
  contents: read

env:
  RELEASE_PLEASE_TARGET_BRANCH: main

jobs:
  release-please:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: write
      issues: write
      pull-requests: write
    outputs:
      prs_created: ${{ steps.release_please.outputs.prs_created }}
      pr_branches: ${{ steps.release_please.outputs.pr_branches }}
      pr_metadata: ${{ steps.release_please.outputs.pr_metadata }}
      releases_created: ${{ steps.release_please.outputs.releases_created }}
      release_tags: ${{ steps.release_please.outputs.release_tags }}
    steps:
      - name: Check out main
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ env.RELEASE_PLEASE_TARGET_BRANCH }}
          fetch-depth: 0
          persist-credentials: false

      # Install only the tools this release workflow needs. cache: false avoids
      # persisting tool downloads on a workflow that has write permissions and
      # release-note LLM secrets.
      - name: Set up mise
        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
        with:
          install_args: node communique
          cache: false

      - name: Install locked Release Please dependency
        env:
          NPM_CONFIG_IGNORE_SCRIPTS: "true"
        run: npm ci --prefix scripts

      - name: Run release-please with Communique notes
        id: release_please
        env:
          GITHUB_TOKEN: ${{ github.token }}
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          COMMUNIQUE_MODEL: ${{ vars.COMMUNIQUE_MODEL }}
        run: |
          set -euo pipefail
          ./scripts/run-release-please.sh

  # Releases created with the workflow token do not trigger the
  # `release: published` workflow, so dispatch the Communique release-note
  # rewrite explicitly for each tag the runner created.
  dispatch-release-notes:
    runs-on: ubuntu-latest
    needs: release-please
    if: ${{ always() && !cancelled() && needs.release-please.outputs.releases_created == 'true' }}
    permissions:
      actions: write
    steps:
      - name: Dispatch Communique release notes for created releases
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAGS: ${{ needs.release-please.outputs.release_tags }}
        run: |
          set -euo pipefail
          read -ra tags <<< "$RELEASE_TAGS"
          for tag in "${tags[@]}"; do
            gh workflow run release-notes.yaml --repo "$GITHUB_REPOSITORY" --ref "$tag" --field "tag=$tag"
          done

  # Branch pushes made with the workflow token do not trigger `pull_request`
  # workflows, so dispatch checks explicitly against the release PR branch head.
  dispatch-checks:
    runs-on: ubuntu-latest
    needs: release-please
    if: ${{ always() && !cancelled() && needs.release-please.outputs.prs_created == 'true' }}
    permissions:
      actions: write
    steps:
      - name: Dispatch checks onto the release PR branch
        env:
          GH_TOKEN: ${{ github.token }}
          PR_METADATA: ${{ needs.release-please.outputs.pr_metadata }}
        run: |
          set -euo pipefail
          node <<'NODE'
          const { spawnSync } = require("node:child_process");

          const repository = process.env.GITHUB_REPOSITORY;
          const prMetadata = JSON.parse(process.env.PR_METADATA || "[]");
          if (typeof repository !== "string" || repository === "") {
            throw new Error("GITHUB_REPOSITORY is required");
          }
          if (!Array.isArray(prMetadata) || prMetadata.length === 0) {
            throw new Error("release PR metadata is required");
          }

          function runGh(args) {
            const result = spawnSync("gh", args, { stdio: "inherit" });
            if (result.status !== 0) {
              throw new Error(`gh ${args.join(" ")} failed with status ${result.status}`);
            }
          }

          for (const pr of prMetadata) {
            if (typeof pr.branch !== "string" || pr.branch === "") {
              throw new Error("release PR branch is required");
            }
            if (typeof pr.title !== "string" || pr.title === "") {
              throw new Error(`release PR title is required for branch ${pr.branch}`);
            }
            runGh([
              "workflow",
              "run",
              "pr-title.yaml",
              "--repo",
              repository,
              "--ref",
              pr.branch,
              "--raw-field",
              `title=${pr.title}`,
            ]);
            runGh(["workflow", "run", "test.yml", "--repo", repository, "--ref", pr.branch]);
          }
          NODE