release.yml

name: Release

on:
  push:
    branches:
      - main

concurrency: ${{ github.workflow }}-${{ github.ref }}

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    outputs:
      should_deploy: ${{ steps.release_tag.outputs.should_deploy }}
      deploy_ref: ${{ steps.release_tag.outputs.deploy_ref }}
      deploy_message: ${{ steps.release_tag.outputs.deploy_message }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v5
        with:
          token: ${{ secrets.RELEASE_REPO_PAT || github.token }}
          fetch-depth: 0

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install

      - name: Create Release PR or Tag
        id: changesets
        uses: changesets/action@v1
        with:
          version: bun run version
          commit: 'chore: version packages'
          title: 'chore: version packages'
          createGithubReleases: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Sync release tag on main
        id: release_tag
        if: |
          github.ref == 'refs/heads/main' &&
          steps.changesets.outputs.hasChangesets == 'false' &&
          steps.changesets.outputs.pullRequestNumber == ''
        run: |
          set -euo pipefail
          git fetch origin main --tags
          git checkout -B release-tag-sync origin/main
          MAIN_SHA=$(git rev-parse HEAD)
          VERSION=$(node -p "require('./package.json').version")
          TAG="v${VERSION}"
          DEPLOY_REF="refs/tags/${TAG}"

          if git rev-parse "${TAG}^{commit}" >/dev/null 2>&1; then
            TAG_SHA=$(git rev-parse "${TAG}^{commit}")
            if [ "${TAG_SHA}" = "${MAIN_SHA}" ]; then
              echo "Tag ${TAG} already points at main HEAD — no deploy"
              echo "should_deploy=false" >> "$GITHUB_OUTPUT"
              exit 0
            fi
            echo "Moving ${TAG} from ${TAG_SHA} to main ${MAIN_SHA}"
            git tag -fa "${TAG}" -m "Release ${TAG}" "${MAIN_SHA}"
            git push -f origin "refs/tags/${TAG}"
          else
            echo "Creating ${TAG} at main ${MAIN_SHA}"
            git tag -a "${TAG}" -m "Release ${TAG}" "${MAIN_SHA}"
            git push origin "refs/tags/${TAG}"
          fi

          echo "should_deploy=true" >> "$GITHUB_OUTPUT"
          echo "deploy_ref=${DEPLOY_REF}" >> "$GITHUB_OUTPUT"
          echo "deploy_message=Deploy release ${TAG} (${MAIN_SHA:0:7})" >> "$GITHUB_OUTPUT"

      - name: No release deploy for this push
        if: steps.release_tag.outputs.should_deploy != 'true'
        run: echo "Skipping production deploy (changesets pending or tag already synced)"

  deploy:
    name: Deploy release
    needs: release
    if: needs.release.outputs.should_deploy == 'true'
    uses: ./.github/workflows/deploy.yml
    with:
      ref: ${{ needs.release.outputs.deploy_ref }}
      deploy_message: ${{ needs.release.outputs.deploy_message }}
    secrets: inherit