release.yml

name: Release

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      force_publish_client:
        description: 'Force publish client to PyPI (even without new release)'
        type: boolean
        default: false
      force_publish_mcp:
        description: 'Force publish MCP to PyPI (even without new release)'
        type: boolean
        default: false

permissions: {}

jobs:
  test:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: "uv.lock"
          python-version: "3.14"

      - name: Install dependencies
        run: uv sync --all-extras

      - name: Run full CI pipeline
        run: uv run poe ci
        env:
          CI_DOCS_BUILD: "true"
          NO_MKDOCS_2_WARNING: "true"
          DISABLE_MKDOCS_2_WARNING: "true"

  release-client:
    needs: test
    runs-on: ubuntu-latest
    concurrency:
      group: release-client
      cancel-in-progress: false
    permissions:
      id-token: write
      contents: write
    outputs:
      released: ${{ steps.release.outputs.released }}
      version: ${{ steps.release.outputs.version }}
      tag: ${{ steps.release.outputs.tag }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          token: ${{ secrets.SEMANTIC_RELEASE_TOKEN }}

      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: "uv.lock"
          python-version: "3.14"

      - name: Install dependencies
        run: uv sync --all-extras

      - name: Check for client changes
        id: check
        run: |
          # Check if there are any commits with (client) scope or no scope since last
          # client release. The optional ``!`` between ``(scope)`` and ``:`` matches
          # the Conventional Commits breaking-change form (e.g. ``feat(client)!:``)
          # so a major-version bump isn't silently skipped — see #451.
          if git log $(git describe --tags --abbrev=0 --match="client-v*" 2>/dev/null || \
            echo "HEAD~10")..HEAD --pretty=format:"%s" | \
            grep -qE '^(feat|fix|perf)(\(client\))?!?:'; then
            echo "has_changes=true" >> $GITHUB_OUTPUT
          else
            echo "has_changes=false" >> $GITHUB_OUTPUT
          fi

      - name: Python Semantic Release (Client)
        if: steps.check.outputs.has_changes == 'true'
        id: release
        uses: python-semantic-release/python-semantic-release@v10.5.3
        with:
          github_token: ${{ secrets.SEMANTIC_RELEASE_TOKEN }}
          verbosity: 2

      - name: Build client package
        if: >-
          (steps.release.outcome == 'success' &&
          steps.release.outputs.released == 'true') ||
          inputs.force_publish_client == true
        run: uv build

      - name: Upload client build artifacts
        if: >-
          (steps.release.outcome == 'success' &&
          steps.release.outputs.released == 'true') ||
          inputs.force_publish_client == true
        uses: actions/upload-artifact@v7
        with:
          name: client-dist
          path: dist/

  release-mcp:
    needs: test
    runs-on: ubuntu-latest
    concurrency:
      group: release-mcp
      cancel-in-progress: false
    permissions:
      id-token: write
      contents: write
    outputs:
      released: ${{ steps.release.outputs.released }}
      version: ${{ steps.release.outputs.version }}
      tag: ${{ steps.release.outputs.tag }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          token: ${{ secrets.SEMANTIC_RELEASE_TOKEN }}

      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: "uv.lock"
          python-version: "3.14"

      - name: Install dependencies
        run: uv sync --all-extras

      - name: Check for MCP changes
        id: check
        run: |
          # Check if there are any commits with (mcp) scope since last mcp release.
          # The optional ``!`` between ``(mcp)`` and ``:`` matches the Conventional
          # Commits breaking-change form (e.g. ``feat(mcp)!:``) so a major-version
          # bump isn't silently skipped — see #451.
          if git log $(git describe --tags --abbrev=0 --match="mcp-v*" 2>/dev/null || \
            echo "HEAD~10")..HEAD --pretty=format:"%s" | \
            grep -qE '^(feat|fix|perf)\(mcp\)!?:'; then
            echo "has_changes=true" >> $GITHUB_OUTPUT
          else
            echo "has_changes=false" >> $GITHUB_OUTPUT
          fi

      - name: Python Semantic Release (MCP)
        if: steps.check.outputs.has_changes == 'true'
        id: release
        uses: python-semantic-release/python-semantic-release@v10.5.3
        with:
          github_token: ${{ secrets.SEMANTIC_RELEASE_TOKEN }}
          verbosity: 2
          directory: katana_mcp_server

      - name: Build MCP package
        if: >-
          (steps.release.outcome == 'success' &&
          steps.release.outputs.released == 'true') ||
          inputs.force_publish_mcp == true
        run: cd katana_mcp_server && uv build

      - name: Upload MCP build artifacts
        if: >-
          (steps.release.outcome == 'success' &&
          steps.release.outputs.released == 'true') ||
          inputs.force_publish_mcp == true
        uses: actions/upload-artifact@v7
        with:
          name: mcp-dist
          path: dist/

  publish-client-pypi:
    name: Publish Client to PyPI
    needs: release-client
    if: needs.release-client.outputs.released == 'true' || inputs.force_publish_client == true
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    steps:
      - name: Download client build artifacts
        uses: actions/download-artifact@v8
        with:
          name: client-dist
          path: dist/

      - name: Publish client to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          attestations: true

  publish-mcp-pypi:
    name: Publish MCP to PyPI
    needs: release-mcp
    if: needs.release-mcp.outputs.released == 'true' || inputs.force_publish_mcp == true
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    steps:
      - name: Download MCP build artifacts
        uses: actions/download-artifact@v8
        with:
          name: mcp-dist
          path: dist/

      - name: Publish MCP to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          attestations: true

  sync-lockfile:
    name: Sync uv.lock after releases
    needs: [release-client, release-mcp]
    if: |
      always() &&
      (needs.release-client.outputs.released == 'true' ||
       needs.release-mcp.outputs.released == 'true')
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          token: ${{ secrets.SEMANTIC_RELEASE_TOKEN }}

      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: "uv.lock"
          python-version: "3.14"

      - name: Sync lockfile
        run: uv sync --all-extras

      - name: Commit if changed
        run: |
          if git diff --quiet uv.lock; then
            echo "uv.lock is up to date"
          else
            git config user.name "github-actions[bot]"
            git config user.email "github-actions[bot]@users.noreply.github.com"
            git add uv.lock
            git commit -m "chore: sync uv.lock after release"
            git push origin main
          fi

  publish-mcp-docker:
    name: Publish MCP Docker Image
    needs: [publish-client-pypi, publish-mcp-pypi, release-client, release-mcp]
    if: |
      always() &&
      (needs.release-client.outputs.released == 'true' ||
       needs.release-mcp.outputs.released == 'true' ||
       inputs.force_publish_mcp == true)
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Determine MCP version for tagging
        id: version
        run: |
          if [ -n "${{ needs.release-mcp.outputs.version }}" ]; then
            echo "mcp_version=${{ needs.release-mcp.outputs.version }}" >> $GITHUB_OUTPUT
          else
            # No MCP release this run — use the latest mcp-v* tag
            LATEST_TAG=$(git tag --list 'mcp-v*' --sort=-version:refname | head -n 1)
            echo "mcp_version=${LATEST_TAG#mcp-v}" >> $GITHUB_OUTPUT
          fi

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ghcr.io/${{ github.repository_owner }}/katana-mcp-server
          tags: |
            type=semver,pattern={{version}},value=${{ steps.version.outputs.mcp_version }}
            type=semver,pattern={{major}}.{{minor}},value=${{ steps.version.outputs.mcp_version }}
            type=semver,pattern={{major}},value=${{ steps.version.outputs.mcp_version }}
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Build and push Docker image
        uses: docker/build-push-action@v7
        with:
          context: ./katana_mcp_server
          file: ./katana_mcp_server/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          platforms: linux/amd64,linux/arm64