release.yml

name: Publish Package

on:
  push:
    tags:
      - 'v*'

permissions:
  id-token: write  # Required for OIDC trusted publishing
  contents: write  # Required for creating GitHub releases

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0  # Fetch all history for changelog generation
          persist-credentials: false

      - name: Verify tag is on main branch
        env:
          COMMIT_SHA: ${{ github.sha }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          # Check if the tag is reachable from main branch
          git fetch origin main
          if ! git merge-base --is-ancestor "$COMMIT_SHA" origin/main; then
            echo "❌ Error: This tag is not on the main branch"
            echo "Tags must be created on the main branch to trigger a release"
            echo "Current tag: $REF_NAME"
            exit 1
          fi
          echo "✅ Tag is on main branch, proceeding with release"

      - name: Setup pnpm
        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
        with:
          version: 11.1.2

      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "22.14.0"

      # Trusted publishing (OIDC) is an npm-registry feature; keep the
      # publish step on the npm CLI even though deps use pnpm.
      - name: Update npm for trusted publishing
        run: npm install -g npm@latest

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Extract version from tag
        id: version
        env:
          REF_NAME: ${{ github.ref_name }}
        run: |
          # Git ref names can legitimately contain shell metacharacters, and
          # this value flows into later steps. Reject anything that is not a
          # clean semver release tag before using it anywhere.
          if [[ ! "$REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
            echo "❌ Error: Tag '$REF_NAME' is not a valid release tag (expected vX.Y.Z)"
            exit 1
          fi
          VERSION="${REF_NAME#v}"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Publishing version: $VERSION"

      - name: Verify tag matches package.json version
        env:
          TAG_VERSION: ${{ steps.version.outputs.version }}
        run: |
          PKG_VERSION=$(node -p "require('./package.json').version")

          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
            echo "❌ Error: Tag version (v$TAG_VERSION) does not match package.json version ($PKG_VERSION)"
            echo "Please ensure package.json version is updated before creating the tag"
            exit 1
          fi

          echo "✅ Version match confirmed: $TAG_VERSION"

      - name: Build SDK
        run: pnpm build

      - name: Run tests
        run: pnpm test

      - name: Generate release notes
        id: release_notes
        env:
          CURRENT_TAG: ${{ github.ref_name }}
          VERSION: ${{ steps.version.outputs.version }}
          REPO: ${{ github.repository }}
        run: |
          # Get the previous version tag (second most recent v* tag by version order)
          # This is more reliable than using git describe which follows commit ancestry
          PREV_TAG=$(git tag -l 'v*' --sort=-version:refname | grep -v "^${CURRENT_TAG}$" | head -1)

          if [ -z "$PREV_TAG" ]; then
            echo "No previous tag found"
          else
            echo "Previous tag: $PREV_TAG"
          fi

          # Get current date
          RELEASE_DATE=$(date +%Y-%m-%d)
          # VERSION is provided via the validated env var declared above

          # Generate changelog with PR links
          if [ -n "$PREV_TAG" ]; then
            echo "Generating changelog from $PREV_TAG to $GITHUB_REF_NAME"
            # Extract commits with PR numbers and format them
            # Use tab as delimiter to safely handle semicolons and special characters
            COMMITS=$(git log "${PREV_TAG}..HEAD" --pretty=format:"%s	%h" --no-merges)
          else
            echo "No previous tag found, using all commits"
            COMMITS=$(git log --pretty=format:"%s	%h" --no-merges)
          fi

          # Process commits and categorize them
          FEATURES=""
          FIXES=""
          OTHER=""

          while IFS=$'\t' read -r message hash; do
            # Skip empty lines
            [ -z "$message" ] && continue

            # Extract PR number if exists
            if [[ $message =~ \(#([0-9]+)\) ]]; then
              PR_NUM="${BASH_REMATCH[1]}"
              # Remove the (#PR_NUM) from message to avoid duplication (handles with or without space)
              CLEAN_MESSAGE=$(echo "$message" | sed -E 's/ ?\(#[0-9]+\)//')
              PR_LINK="[#$PR_NUM](https://github.com/$REPO/pull/$PR_NUM)"
              COMMIT_LINK="[$hash](https://github.com/$REPO/commit/$hash)"
              ITEM="$CLEAN_MESSAGE ($PR_LINK) ($COMMIT_LINK)"
            else
              COMMIT_LINK="[$hash](https://github.com/$REPO/commit/$hash)"
              ITEM="$message ($COMMIT_LINK)"
            fi

            # Categorize by prefix and strip conventional commit prefix
            if [[ $message =~ ^feat(\([^\)]+\))?: ]]; then
              # Strip "feat:" or "feat(scope):" from the beginning of ITEM
              STRIPPED_ITEM=$(echo "$ITEM" | sed -E 's/^feat(\([^)]+\))?: //')
              FEATURES="${FEATURES}- ${STRIPPED_ITEM}
          "
            elif [[ $message =~ ^fix(\([^\)]+\))?: ]]; then
              # Strip "fix:" or "fix(scope):" from the beginning of ITEM
              STRIPPED_ITEM=$(echo "$ITEM" | sed -E 's/^fix(\([^)]+\))?: //')
              FIXES="${FIXES}- ${STRIPPED_ITEM}
          "
            else
              OTHER="${OTHER}- ${ITEM}
          "
            fi
          done <<< "$COMMITS"

          # Create release notes
          cat > release_notes.md <<EOF
          $VERSION ($RELEASE_DATE)
          EOF

          # Add Features section if exists
          if [ -n "$FEATURES" ]; then
            cat >> release_notes.md <<EOF

          ## Features

          $FEATURES
          EOF
          fi

          # Add Fixes section if exists
          if [ -n "$FIXES" ]; then
            cat >> release_notes.md <<EOF

          ## Bug Fixes

          $FIXES
          EOF
          fi

          # Add Other changes if exists
          if [ -n "$OTHER" ]; then
            cat >> release_notes.md <<EOF

          ## Changes

          $OTHER
          EOF
          fi

          # Add npm package link
          cat >> release_notes.md <<EOF

          ## Install

          \`\`\`bash
          npm install @formo/analytics-node@$VERSION
          \`\`\`

          [@formo/analytics-node $VERSION npm package](https://www.npmjs.com/package/@formo/analytics-node/v/$VERSION)
          EOF

      - name: Publish to npm
        run: npm publish --provenance
        # Explicitly use --provenance flag for clarity
        # OIDC trusted publishing (id-token: write) enables automatic provenance generation

      - name: Create GitHub Release
        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
        with:
          body_path: release_notes.md
          draft: false
          prerelease: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}