auto-release.yml

name: Auto Release on Merge

on:
  push:
    branches: [main]

permissions:
  contents: write

jobs:
  auto-release:
    # Only run for dependency maintenance merges (patch bumps)
    if: contains(github.event.head_commit.message, '[deps]') || contains(github.event.head_commit.message, 'Dependency updates and security patches')
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0

      - name: Extract version from package.json
        id: version
        run: |
          VERSION=$(jq -r '.version' package.json)
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "tag=v$VERSION" >> $GITHUB_OUTPUT
          echo "Detected version: $VERSION"

      - name: Check if tag already exists
        id: check-tag
        run: |
          if git rev-parse "v${{ steps.version.outputs.version }}" >/dev/null 2>&1; then
            echo "exists=true" >> $GITHUB_OUTPUT
            echo "Tag v${{ steps.version.outputs.version }} already exists, skipping"
          else
            echo "exists=false" >> $GITHUB_OUTPUT
            echo "Tag v${{ steps.version.outputs.version }} does not exist, will create"
          fi

      - name: Create git tag
        if: steps.check-tag.outputs.exists == 'false'
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git tag -a "v${{ steps.version.outputs.version }}" -m "Release v${{ steps.version.outputs.version }} - Dependency updates and security patches"
          git push origin "v${{ steps.version.outputs.version }}"

      - name: Create GitHub release
        if: steps.check-tag.outputs.exists == 'false'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          RELEASE_FILE="releases/v${VERSION}.md"

          if [ -f "$RELEASE_FILE" ]; then
            gh release create "v${VERSION}" \
              --title "v${VERSION} - Dependency updates and security patches" \
              --notes-file "$RELEASE_FILE"
          else
            gh release create "v${VERSION}" \
              --title "v${VERSION} - Dependency updates and security patches" \
              --generate-notes
          fi

          echo "✅ Release v${VERSION} created"
          echo "📦 npm publish will be triggered by the release event"
          echo "🐳 Docker publish will be triggered by lint-and-test on main"