release.yml

# Versioning PRs (changesets) still run from CI. Automated `npm publish` is disabled
# until the team adopts this repo; publish packages manually in the meantime.
# To re-enable: set ENABLE_CICD_NPM_PUBLISH to 'true' on the release job and restore
# `publish: bun run release:publish` on the changesets/action step.
name: Release

on:
  push:
    branches:
      - master
      - develop
    # Avoid running release on docs-only changes.
    # Releases should be driven by Changesets (new .changeset files) and the
    # resulting version-bump commits (packages/*/package.json + CHANGELOG.md).
    paths:
      - ".changeset/**"
      - "packages/**"
      - "package.json"
      - "bun.lock"
      - "turbo.json"
      - "tsconfig*.json"
      - ".github/workflows/release.yml"
  workflow_dispatch:
    inputs:
      release_intent:
        description: "What should this manual run do? (The 'publish' option is rejected while ENABLE_CICD_NPM_PUBLISH is false.)"
        required: true
        type: choice
        options:
          - version-pr
          - publish
        default: version-pr
      force_publish:
        description: "Allow manual publish even when version-bump detection is false (use for reruns/recovery)"
        required: false
        type: boolean
        default: false
      version_type:
        description: 'Version bump type (major/minor/patch)'
        required: false
        type: choice
        options:
          - auto
          - major
          - minor
          - patch
      publish_auth:
        description: "Publish auth mode for manual publish runs"
        required: false
        type: choice
        options:
          - auto
          - token
          - oidc
        default: auto
      release_channel:
        description: "Publish channel (auto maps branch: master->stable, develop->next)"
        required: false
        type: choice
        options:
          - auto
          - stable
          - next
          - beta
        default: auto

concurrency: ${{ github.workflow }}-${{ github.ref }}

jobs:
  release:
    name: Release (version PRs only; npm publish off)
    runs-on: ubuntu-latest
    env:
      PUBLISH_NPM_TOKEN: ""
      PUBLISH_NODE_AUTH_TOKEN: ""
      # Flip to 'true' and restore `publish: bun run release:publish` on changesets/action to re-enable CI publish.
      ENABLE_CICD_NPM_PUBLISH: "true"
    permissions:
      contents: write
      pull-requests: write
      id-token: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20.x

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.13

      - name: Cache Bun downloads
        uses: actions/cache@v4
        with:
          path: |
            ~/.bun/install/cache
          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-bun-

      - name: Configure Git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Detect release intent (changesets or version bumps)
        id: detect
        shell: bash
        run: |
          set -euo pipefail

          # Are there any Changesets present in the repo at this commit?
          # Ignore the .changeset/README.md fixture file which is part of the
          # changesets bootstrap and never represents a real changeset entry.
          if find .changeset -maxdepth 1 -type f -name '*.md' ! -name 'README.md' -print -quit | grep -q .; then
            echo "has_changesets=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_changesets=false" >> "$GITHUB_OUTPUT"
          fi

          # Did this push include actual package version bumps (i.e. merged release PR)?
          before="${{ github.event.before }}"
          after="${{ github.sha }}"
          changed_manifests="$(git diff --name-only "$before" "$after" -- 'packages/**/package.json' 'tools/**/package.json' || true)"

          has_version_bumps=false
          for manifest in $changed_manifests; do
            if ! node -e 'const fs=require("fs"); const p=process.argv[1]; try { const pkg=JSON.parse(fs.readFileSync(p, "utf8")); process.exit(pkg.private ? 1 : 0); } catch { process.exit(1); }' "$manifest"; then
              continue
            fi
            manifest_diff="$(git diff -U0 "$before" "$after" -- "$manifest" || true)"
            # Require both removed and added "version" lines to avoid treating
            # metadata-only package.json edits as publish intents.
            if echo "$manifest_diff" | grep -Eq '^-\\s*"version"\\s*:' && echo "$manifest_diff" | grep -Eq '^\\+\\s*"version"\\s*:'; then
              has_version_bumps=true
              break
            fi
          done

          echo "has_version_bumps=${has_version_bumps}" >> "$GITHUB_OUTPUT"

      - name: Validate manual release intent prerequisites
        if: github.event_name == 'workflow_dispatch'
        shell: bash
        run: |
          set -euo pipefail
          intent="${{ inputs.release_intent }}"
          has_changesets="${{ steps.detect.outputs.has_changesets }}"
          has_version_bumps="${{ steps.detect.outputs.has_version_bumps }}"
          force_publish="${{ inputs.force_publish }}"

          if [ "$intent" = "version-pr" ] && [ "$has_changesets" != "true" ]; then
            echo "Manual intent 'version-pr' requires at least one .changeset/*.md file in this commit."
            exit 1
          fi

          if [ "$intent" = "publish" ] && [ "$has_version_bumps" != "true" ] && [ "$force_publish" != "true" ]; then
            echo "Manual intent 'publish' requires package.json/CHANGELOG.md version bump changes."
            echo "If you are rerunning/recovering a failed publish from master, re-run with force_publish=true."
            exit 1
          fi

          if [ "$intent" = "publish" ] && [ "${ENABLE_CICD_NPM_PUBLISH:-false}" != "true" ]; then
            echo "Automated npm publish from GitHub Actions is disabled (ENABLE_CICD_NPM_PUBLISH != true)."
            echo "Publish manually, or set ENABLE_CICD_NPM_PUBLISH=true and restore the changesets/action publish input in .github/workflows/release.yml."
            exit 1
          fi

      - name: Resolve release channel
        if: env.ENABLE_CICD_NPM_PUBLISH == 'true' && ((github.event_name == 'workflow_dispatch' && inputs.release_intent == 'publish') || (github.event_name != 'workflow_dispatch' && steps.detect.outputs.has_version_bumps == 'true'))
        id: release_channel
        shell: bash
        run: |
          set -euo pipefail
          ref_name="${{ github.ref_name }}"
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            channel="${{ inputs.release_channel }}"
            if [ "${{ inputs.release_intent }}" != "publish" ]; then
              channel="auto"
            fi
          else
            channel="auto"
          fi

          if [ "${channel}" = "auto" ]; then
            if [ "${ref_name}" = "develop" ]; then
              channel="next"
            elif [ "${ref_name}" = "master" ]; then
              channel="stable"
            else
              echo "Auto release channel is only supported on master or develop; got ${ref_name}" >&2
              exit 1
            fi
          fi

          case "${channel}" in
            stable|next|beta) ;;
            *)
              echo "Unsupported release channel: ${channel}" >&2
              exit 1
              ;;
          esac

          echo "channel=${channel}" >> "$GITHUB_OUTPUT"
          if [ "${channel}" = "stable" ]; then
            echo "npm_tag=latest" >> "$GITHUB_OUTPUT"
          else
            echo "npm_tag=${channel}" >> "$GITHUB_OUTPUT"
          fi
          echo "Resolved release channel: ${channel}"

      - name: Enforce branch to channel policy
        if: env.ENABLE_CICD_NPM_PUBLISH == 'true' && ((github.event_name == 'workflow_dispatch' && inputs.release_intent == 'publish') || (github.event_name != 'workflow_dispatch' && steps.detect.outputs.has_version_bumps == 'true'))
        shell: bash
        run: |
          set -euo pipefail
          ref_name="${{ github.ref_name }}"
          channel="${{ steps.release_channel.outputs.channel }}"

          if [ "${ref_name}" = "develop" ] && [ "${channel}" != "next" ]; then
            echo "develop branch publish must use release channel 'next'." >&2
            exit 1
          fi
          if [ "${ref_name}" = "master" ] && [ "${channel}" != "stable" ]; then
            echo "master branch publish must use release channel 'stable'." >&2
            exit 1
          fi

          echo "Branch/channel policy validated: ${ref_name} -> ${channel}"

      - name: Stop early (no changesets / no version bumps)
        if: github.event_name != 'workflow_dispatch' && steps.detect.outputs.has_changesets != 'true' && steps.detect.outputs.has_version_bumps != 'true'
        run: |
          echo "No .changeset files and no package version/changelog updates in this push. Skipping release."
          exit 0

      - name: Build packages (publish runs only)
        if: env.ENABLE_CICD_NPM_PUBLISH == 'true' && ((github.event_name == 'workflow_dispatch' && inputs.release_intent == 'publish') || (github.event_name != 'workflow_dispatch' && steps.detect.outputs.has_version_bumps == 'true'))
        run: bun run build

      - name: Run tests (publish runs only)
        if: env.ENABLE_CICD_NPM_PUBLISH == 'true' && ((github.event_name == 'workflow_dispatch' && inputs.release_intent == 'publish') || (github.event_name != 'workflow_dispatch' && steps.detect.outputs.has_version_bumps == 'true'))
        run: bun run test

      - name: Resolve npm publish auth mode
        if: env.ENABLE_CICD_NPM_PUBLISH == 'true' && ((github.event_name == 'workflow_dispatch' && inputs.release_intent == 'publish') || (github.event_name != 'workflow_dispatch' && steps.detect.outputs.has_version_bumps == 'true'))
        id: npm_auth
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          set -euo pipefail
          REGISTRY="$(npm config get registry)"
          echo "npm registry: ${REGISTRY}"
          if [ "${REGISTRY}" != "https://registry.npmjs.org/" ]; then
            echo "Unexpected npm registry configured: ${REGISTRY}" >&2
            exit 1
          fi

          publish_auth_input="auto"
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            publish_auth_input="${{ inputs.publish_auth }}"
          fi

          if [ "${publish_auth_input}" = "token" ]; then
            if [ -z "${NPM_TOKEN:-}" ]; then
              echo "publish_auth=token requires NPM_TOKEN secret." >&2
              exit 1
            fi
            echo "mode=token" >> "$GITHUB_OUTPUT"
          elif [ "${publish_auth_input}" = "oidc" ]; then
            echo "mode=oidc" >> "$GITHUB_OUTPUT"
          else
            if [ -n "${NPM_TOKEN:-}" ]; then
              echo "mode=token" >> "$GITHUB_OUTPUT"
            else
              echo "mode=oidc" >> "$GITHUB_OUTPUT"
            fi
          fi

      - name: Configure token auth for npm publish
        if: env.ENABLE_CICD_NPM_PUBLISH == 'true' && steps.npm_auth.outputs.mode == 'token'
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          set -euo pipefail
          echo "Using token auth for npm publish."
          echo "PUBLISH_NPM_TOKEN=${NPM_TOKEN}" >> "$GITHUB_ENV"
          echo "PUBLISH_NODE_AUTH_TOKEN=${NPM_TOKEN}" >> "$GITHUB_ENV"

      - name: Configure OIDC auth for npm publish
        if: env.ENABLE_CICD_NPM_PUBLISH == 'true' && steps.npm_auth.outputs.mode == 'oidc'
        run: |
          set -euo pipefail
          echo "Using OIDC trusted publishing for npm publish."
          echo "PUBLISH_NPM_TOKEN=" >> "$GITHUB_ENV"
          echo "PUBLISH_NODE_AUTH_TOKEN=" >> "$GITHUB_ENV"

      - name: Create release pull request (npm publish disabled in CI)
        if: github.event_name == 'workflow_dispatch' || steps.detect.outputs.has_changesets == 'true' || steps.detect.outputs.has_version_bumps == 'true'
        id: changesets
        uses: changesets/action@v1
        with:
          # Omit `publish` so the action never runs `bun run release:publish` from CI.
          # Re-enable publishing by setting ENABLE_CICD_NPM_PUBLISH=true and adding:
          publish: bun run release:publish
          createGithubReleases: false
          version: bun run version
          title: 'chore(release): version packages [skip-heavy-ci]'
          commit: 'chore(release): version packages'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_TOKEN: ${{ env.PUBLISH_NPM_TOKEN }}
          NODE_AUTH_TOKEN: ${{ env.PUBLISH_NODE_AUTH_TOKEN }}
          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
          RELEASE_CHANNEL: ${{ steps.release_channel.outputs.channel }}

      - name: Create GitHub Release
        if: steps.changesets.outputs.published == 'true'
        uses: actions/create-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          # changesets/action outputs `publishedPackages` as a JSON string; parse it before indexing.
          tag_name: v${{ fromJson(steps.changesets.outputs.publishedPackages)[0].version }}
          release_name: Release v${{ fromJson(steps.changesets.outputs.publishedPackages)[0].version }}
          body: |
            ## Changes

            ${{ steps.changesets.outputs.publishedPackages }}

            See CHANGELOG.md files in each package for detailed changes.
          draft: false
          prerelease: false

      - name: Notify Slack on Successful Publish
        if: steps.changesets.outputs.published == 'true'
        continue-on-error: true
        uses: slackapi/slack-github-action@v1.27.0
        with:
          payload: |
            {
              "text": "📦 PIE Elements Package Published to NPM",
              "blocks": [
                {
                  "type": "header",
                  "text": {
                    "type": "plain_text",
                    "text": "📦 NPM Package Published"
                  }
                },
                {
                  "type": "section",
                  "fields": [
                    {
                      "type": "mrkdwn",
                      "text": "*Repository:*\n${{ github.repository }}"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Version:*\nv${{ fromJson(steps.changesets.outputs.publishedPackages)[0].version }}"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Package:*\n${{ fromJson(steps.changesets.outputs.publishedPackages)[0].name }}"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Branch:*\n${{ github.ref_name }}"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Commit:*\n<${{ github.event.head_commit.url }}|${{ github.sha }}>"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Workflow:*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View Run>"
                    }
                  ]
                },
                {
                  "type": "context",
                  "elements": [
                    {
                      "type": "mrkdwn",
                      "text": "See the workflow summary for the full published package list."
                    }
                  ]
                }
              ]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL || secrets.SLACK_PR_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

      - name: Notify Slack on Release PR Created/Updated
        if: steps.changesets.outputs.hasChangesets == 'true' && steps.changesets.outputs.published != 'true'
        continue-on-error: true
        uses: slackapi/slack-github-action@v1.27.0
        with:
          payload: |
            {
              "text": "📝 Release PR updated",
              "blocks": [
                {
                  "type": "header",
                  "text": {
                    "type": "plain_text",
                    "text": "📝 Release PR Created/Updated"
                  }
                },
                {
                  "type": "section",
                  "fields": [
                    {
                      "type": "mrkdwn",
                      "text": "*Repository:*\n${{ github.repository }}"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Branch:*\n${{ github.ref_name }}"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Workflow:*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View Run>"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Release PR:*\n${{ steps.changesets.outputs.pullRequestUrl || 'Created/updated by changesets action' }}"
                    }
                  ]
                }
              ]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL || secrets.SLACK_PR_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

      - name: Notify Slack on Release Failure
        if: failure()
        continue-on-error: true
        uses: slackapi/slack-github-action@v1.27.0
        with:
          payload: |
            {
              "text": "❌ PIE Elements Release Failed",
              "blocks": [
                {
                  "type": "header",
                  "text": {
                    "type": "plain_text",
                    "text": "❌ NPM Release Failed"
                  }
                },
                {
                  "type": "section",
                  "fields": [
                    {
                      "type": "mrkdwn",
                      "text": "*Repository:*\n${{ github.repository }}"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Branch:*\n${{ github.ref_name }}"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Commit:*\n<${{ github.event.head_commit.url }}|${{ github.sha }}>"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Author:*\n${{ github.event.head_commit.author.name }}"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Workflow:*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View Run>"
                    }
                  ]
                }
              ]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL || secrets.SLACK_PR_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK