release.yml

name: Release

permissions: {}

on:
  push:
    tags:
      - 'v*'

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0

      - name: ⎔ Setup pnpm
        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6

      - name: ⎔ Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 24
          cache: pnpm

      - name: 📥 Install dependencies
        run: pnpm install --ignore-scripts --frozen-lockfile

      - name: 🔍 Type Check
        run: pnpm run typecheck

      - name: 🧪 Test
        run: pnpm run test

      - name: 🏗️ Build
        run: pnpm run build

      - name: 📦 Validate build artifacts
        run: |
          # Check if dist directory exists
          if [ ! -d "dist" ]; then
            echo "❌ dist directory is missing but declared in package.json"
            exit 1
          fi

          # Check if dist contains files
          if [ -z "$(ls -A dist)" ]; then
            echo "❌ dist directory is empty"
            exit 1
          fi

          # Check for index.js and index.d.ts
          if [ ! -f "dist/index.js" ] || [ ! -f "dist/index.d.ts" ]; then
            echo "❌ Missing required files in dist/"
            echo "Required: index.js and index.d.ts"
            echo "Found: $(ls dist)"
            exit 1
          fi

          echo "✅ Build artifacts validation passed"

      - name: 📤 Upload package artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: package
          path: |
            dist/
            src/data/
            package.json
            README.md
            LICENSE
          retention-days: 1
          if-no-files-found: error
    permissions:
      contents: read

  publish:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - name: 📥 Download package artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: package

      - name: ⎔ Setup pnpm
        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6

      - name: ⎔ Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 24
          registry-url: 'https://registry.npmjs.org'

      - name: 📦 Publish to NPM
        run: pnpm publish --no-git-checks --ignore-scripts
        env:
          NODE_AUTH_TOKEN: "" # Clear placeholder set by setup-node to enable OIDC

  release-notes:
    needs: publish
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0

      - name: ⎔ Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 24

      - name: 📝 Update Changelog
        run: npx changelogithub@14.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  notify:
    needs: [build, publish, release-notes]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: 📣 Notify release result
        uses: marimo-team/internal-gh-actions/release-notification@ba06d4db1f3c5c9b86983ce409e57196f8376777 # main
        with:
          status: ${{ (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')) && 'failure' || 'success' }}
          slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL_RELEASES }}
          artifact-url: "https://npmjs.com/package/@marimo-team/codemirror-sql"
    permissions:
      contents: read