create-release.yml

name: 🚀 Create release

on:
  push: # Temporarily added for testing
    branches: feat-create-request
  workflow_dispatch:
    inputs:
      local-build:
        default: false
        description: Use local build
        type: boolean

      skip-release:
        default: false
        description: Skip release
        type: boolean

defaults:
  run:
    shell: bash

env:
  # build-on: ${{ case(inputs.local-build || false, 'local', 'azdo') }}
  build-on: local
  node-version: 22

jobs:
  build:
    environment:
      deployment: false
      name: azure-devops
    name: Build
    outputs:
      version: ${{ steps.get-version.outputs.version }}
      version-type: ${{ steps.get-version.outputs.version-type }}
    permissions:
      contents: read
      id-token: write
    runs-on: ubuntu-latest
    timeout-minutes: 45

    steps:
      - uses: actions/checkout@v6

      - id: get-branch-name
        name: Get branch name
        run: |
          BRANCH_NAME=$(git symbolic-ref --short HEAD 2>/dev/null || git rev-parse --short HEAD)

          echo branch-name=$BRANCH_NAME | tee --append $GITHUB_OUTPUT

      - id: azdo-build
        if: env.build-on == 'azdo'
        name: Build (Azure DevOps)
        timeout-minutes: 45
        uses: ./.github/actions/azdo-build
        with:
          azdo-org: ${{ vars.AZDO_ORG }}
          azdo-pipeline-name: ${{ vars.AZDO_PIPELINE_NAME }}
          azdo-project: ${{ vars.AZDO_PROJECT }}
          azure-client-id: ${{ vars.AZURE_CLIENT_ID }}
          azure-subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
          azure-tenant-id: ${{ vars.AZURE_TENANT_ID }}
          pipeline-variable: |
            ProjectBranch=${{ steps.get-branch-name.outputs.branch-name }}
            ProjectRepository=${{ github.repository }}

      - id: local-build
        if: env.build-on == 'local'
        name: Build (local)
        uses: ./.github/actions/local-build

      - id: get-version
        name: Get version
        run: |
          echo version=${{ case(env.build-on == 'local', steps.local-build.outputs.version, steps.azdo-build.outputs.version) }} | tee --append $GITHUB_OUTPUT
          echo version-type=${{ case(env.build-on == 'local', steps.local-build.outputs.version-type, steps.azdo-build.outputs.version-type) }} | tee --append $GITHUB_OUTPUT

  upload-changelog:
    name: Upload changelog
    needs: build
    permissions:
      contents: read
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v6
        with:
          node-version: ${{ env.node-version }}

      - run: npm install --global keep-a-changelog@2 prettier

      - if: needs.build.outputs.version-type != 'production'
        name: Tag unreleased as latest
        run: |
          npx keep-a-changelog --format markdownlint --release=${{ needs.build.outputs.version }}
          cat CHANGELOG.md

      - name: Extract latest entry
        run: npx keep-a-changelog --format markdownlint --latest-release-full | tee ./CHANGELOG.latest.md

      - name: Format extracted entry
        run: npx prettier CHANGELOG.latest.md --tab-width 3 --write

      - name: Upload changelog
        uses: actions/upload-artifact@v7
        with:
          name: changelog
          path: ./CHANGELOG.latest.md

  release:
    environment:
      name: github-release
      url: ${{ github.server_url }}/${{ github.repository }}/releases/tag/${{ steps.release.outputs.tag }}
    name: Release
    needs:
      - build
      - upload-changelog
    permissions:
      contents: write
    runs-on: ubuntu-latest

    steps:
      - name: Download artifact (tarball)
        uses: actions/download-artifact@v8
        with:
          name: tarball
          path: ./asset

      - name: Download artifact (bundle-iife)
        uses: actions/download-artifact@v8
        with:
          name: bundle-iife
          path: ./asset

      - name: Download artifact (changelog)
        uses: actions/download-artifact@v8
        with:
          name: changelog
          path: ./

      - continue-on-error: true
        name: Download artifact (sbom)
        uses: actions/download-artifact@v8
        with:
          name: sbom
          path: ./asset

      - id: compute-hash
        name: Compute build metadata
        run: |
          echo git-short-sha=`echo ${{ github.sha }} | cut -c 1-7` | tee --append $GITHUB_OUTPUT
          echo release-date=`date "+%Y-%m-%d %R:%S"` | tee --append $GITHUB_OUTPUT
          echo sha384-es5=`cat ./asset/webchat-es5.js | openssl dgst -sha384 -binary | openssl base64 -A` | tee --append $GITHUB_OUTPUT
          echo sha384-full=`cat ./asset/webchat.js | openssl dgst -sha384 -binary | openssl base64 -A` | tee --append $GITHUB_OUTPUT
          echo sha384-minimal=`cat ./asset/webchat-minimal.js | openssl dgst -sha384 -binary | openssl base64 -A` | tee --append $GITHUB_OUTPUT

      - name: Build release notes
        run: |
          tee ./release.txt <<EOF
          This release is for internal testing only. **Please do not use this build in production environment.**

          | Build time | Run ID | Source version | Git ref | Package version |
          | - | - | - | - | - |
          | ${{ steps.compute-hash.outputs.release-date }}Z | [\`${{ github.run_id }}\`](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) | [\`${{ steps.compute-hash.outputs.git-short-sha }}\`](https://github.com/${{ github.repository }}/commit/${{ github.sha }}) | \`${{ github.ref }}\` | \`${{ needs.build.outputs.version }}\` |

          \`\`\`html
          <script
            crossorigin="anonymous"
            integrity="sha384-${{ steps.compute-hash.outputs.sha384-full }}"
            src="https://cdn.botframework.com/botframework-webchat@${{ needs.build.outputs.version }}/dist/webchat.js"
          ></script>

          <script
            crossorigin="anonymous"
            integrity="sha384-${{ steps.compute-hash.outputs.sha384-es5 }}"
            src="https://cdn.botframework.com/botframework-webchat@${{ needs.build.outputs.version }}/dist/webchat-es5.js"
          ></script>

          <script
            crossorigin="anonymous"
            integrity="sha384-${{ steps.compute-hash.outputs.sha384-minimal }}"
            src="https://cdn.botframework.com/botframework-webchat@${{ needs.build.outputs.version }}/dist/webchat-minimal.js"
          ></script>
          \`\`\`

          # Changelog

          EOF

          cat ./CHANGELOG.latest.md | tee --append ./release.txt

      - uses: actions/upload-artifact@v7
        with:
          name: release-notes
          overwrite: true
          path: ./release.txt

      - env:
          # Use actions/create-github-app-token if create release would need to trigger another workflow.
          GH_TOKEN: ${{ github.token }}
        id: release
        if: '!inputs.skip-release'
        name: Create release
        # Do not upload assets while creating release, otherwise, it will not trigger "release created" event.
        run: |
          if [[ "${{ needs.build.outputs.version-type }}" == "prerelease" ]]; then PRERELEASE=1; fi

          TAG=v${{ needs.build.outputs.version }}

          gh release create $TAG \
            --notes-file ./release.txt \
            ${PRERELEASE:+--prerelease} \
            --repo ${{ github.repository }} \
            --target ${{ github.ref }}

          echo tag=$TAG | tee --append $GITHUB_OUTPUT
      - env:
          GH_TOKEN: ${{ github.token }}
        if: '!inputs.skip-release'
        name: Upload assets
        run: |
          gh release upload ${{ steps.release.outputs.tag }} \
            --repo ${{ github.repository }} \
            ./asset/*