release.yml

name: Release

on:
  push:
    branches:
      - master
    # Only run when relevant files change.
    # Releases are driven by Changesets (.changeset files) and the
    # resulting version-bump commits (packages/*/package.json + CHANGELOG.md).
    paths:
      - ".changeset/**"
      - "packages/**"
      - "tools/**"
      - "package.json"
      - "bun.lock"
      - "turbo.json"
      - "tsconfig*.json"
      - ".github/workflows/release.yml"
  workflow_dispatch:
    inputs:
      release_intent:
        description: "What should this manual run do?"
        required: true
        type: choice
        options:
          - version-pr
          - publish
        default: version-pr
      force_publish:
        description: "Allow manual publish even when version-bump detection is false (use for reruns/recovery)"
        required: false
        type: boolean
        default: false
      publish_auth:
        description: "Publish auth mode for manual publish runs"
        required: false
        type: choice
        options:
          - auto
          - token
          - oidc
        default: auto

concurrency: ${{ github.workflow }}-${{ github.ref }}

jobs:
  release:
    name: Release to NPM
    runs-on: ubuntu-latest
    env:
      PUBLISH_NPM_TOKEN: ""
      PUBLISH_NODE_AUTH_TOKEN: ""
    permissions:
      contents: write
      pull-requests: write
      id-token: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20.19.0
          registry-url: https://registry.npmjs.org
          always-auth: true

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version-file: package.json

      - name: Cache Bun downloads
        uses: actions/cache@v4
        with:
          path: ~/.bun/install/cache
          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
          restore-keys: |
            ${{ runner.os }}-bun-

      - name: Configure Git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Detect release intent (changesets or version bumps)
        id: detect
        shell: bash
        run: |
          set -euo pipefail

          # Are there any Changesets present in the repo at this commit?
          if ls .changeset/*.md >/dev/null 2>&1; then
            echo "has_changesets=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_changesets=false" >> "$GITHUB_OUTPUT"
          fi

          # Did this push include actual package version bumps (i.e. merged release PR)?
          before="${{ github.event.before }}"
          after="${{ github.sha }}"
          version_diff="$(git diff -U0 "$before" "$after" -- packages/*/package.json tools/*/package.json || true)"

          # Require both removed and added "version" lines to avoid treating metadata-only
          # package.json edits as publish intents.
          if echo "$version_diff" | grep -Eq '^-[[:space:]]*"version"[[:space:]]*:' && echo "$version_diff" | grep -Eq '^\+[[:space:]]*"version"[[:space:]]*:'; then
            echo "has_version_bumps=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_version_bumps=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Validate manual release intent prerequisites
        if: github.event_name == 'workflow_dispatch'
        shell: bash
        run: |
          set -euo pipefail
          intent="${{ inputs.release_intent }}"
          has_changesets="${{ steps.detect.outputs.has_changesets }}"
          has_version_bumps="${{ steps.detect.outputs.has_version_bumps }}"
          force_publish="${{ inputs.force_publish }}"

          if [ "$intent" = "version-pr" ] && [ "$has_changesets" != "true" ]; then
            echo "Manual intent 'version-pr' requires at least one .changeset/*.md file in this commit."
            exit 1
          fi

          if [ "$intent" = "publish" ] && [ "$has_version_bumps" != "true" ] && [ "$force_publish" != "true" ]; then
            echo "Manual intent 'publish' requires package.json/CHANGELOG.md version bump changes."
            echo "If you are rerunning/recovering a failed publish from master, re-run with force_publish=true."
            exit 1
          fi

      - name: Generate temporary patch changeset (master auto-release prep)
        id: temp_changeset
        if: github.event_name != 'workflow_dispatch' && steps.detect.outputs.has_changesets != 'true' && steps.detect.outputs.has_version_bumps != 'true'
        run: |
          bun ./scripts/create-temporary-release-changeset.mjs
          echo "created=true" >> "$GITHUB_OUTPUT"

      - name: Run full publish readiness checks (publish runs only)
        if: (github.event_name == 'workflow_dispatch' && inputs.release_intent == 'publish') || (github.event_name != 'workflow_dispatch' && steps.detect.outputs.has_version_bumps == 'true')
        run: bun run verify:publish

      - name: Run tests (publish runs only)
        if: (github.event_name == 'workflow_dispatch' && inputs.release_intent == 'publish') || (github.event_name != 'workflow_dispatch' && steps.detect.outputs.has_version_bumps == 'true')
        run: bun run test

      - name: Check fixed monorepo versioning invariants (publish runs only)
        if: (github.event_name == 'workflow_dispatch' && inputs.release_intent == 'publish') || (github.event_name != 'workflow_dispatch' && steps.detect.outputs.has_version_bumps == 'true')
        run: bun run check:fixed-versioning:full

      - name: Resolve npm publish auth mode
        if: (github.event_name == 'workflow_dispatch' && inputs.release_intent == 'publish') || (github.event_name != 'workflow_dispatch' && steps.detect.outputs.has_version_bumps == 'true')
        id: npm_auth
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          set -euo pipefail
          REGISTRY="$(npm config get registry)"
          echo "npm registry: ${REGISTRY}"
          if [ "${REGISTRY}" != "https://registry.npmjs.org/" ]; then
            echo "Unexpected npm registry configured: ${REGISTRY}" >&2
            exit 1
          fi

          publish_auth_input="auto"
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            publish_auth_input="${{ inputs.publish_auth }}"
          fi

          if [ "${publish_auth_input}" = "token" ]; then
            if [ -z "${NPM_TOKEN:-}" ]; then
              echo "publish_auth=token requires NPM_TOKEN secret." >&2
              exit 1
            fi
            echo "mode=token" >> "$GITHUB_OUTPUT"
          elif [ "${publish_auth_input}" = "oidc" ]; then
            echo "mode=oidc" >> "$GITHUB_OUTPUT"
          else
            if [ -n "${NPM_TOKEN:-}" ]; then
              echo "mode=token" >> "$GITHUB_OUTPUT"
            else
              echo "mode=oidc" >> "$GITHUB_OUTPUT"
            fi
          fi

      - name: Configure token auth for npm publish
        if: steps.npm_auth.outputs.mode == 'token'
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          set -euo pipefail
          echo "Using token auth for npm publish."
          echo "PUBLISH_NPM_TOKEN=${NPM_TOKEN}" >> "$GITHUB_ENV"
          echo "PUBLISH_NODE_AUTH_TOKEN=${NPM_TOKEN}" >> "$GITHUB_ENV"

      - name: Configure OIDC auth for npm publish
        if: steps.npm_auth.outputs.mode == 'oidc'
        run: |
          set -euo pipefail
          echo "Using OIDC trusted publishing for npm publish."
          echo "PUBLISH_NPM_TOKEN=" >> "$GITHUB_ENV"
          echo "PUBLISH_NODE_AUTH_TOKEN=" >> "$GITHUB_ENV"

      - name: Create Release Pull Request or Publish to NPM
        if: github.event_name == 'workflow_dispatch' || steps.detect.outputs.has_changesets == 'true' || steps.detect.outputs.has_version_bumps == 'true' || steps.temp_changeset.outputs.created == 'true'
        id: changesets
        uses: changesets/action@v1
        with:
          # release script handles: workspace range rewriting, build, publish, restore
          publish: node scripts/changeset-publish-resolved-workspaces.mjs
          version: bun run version
          title: 'chore(release): version packages [skip-heavy-ci]'
          commit: 'chore(release): version packages'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_TOKEN: ${{ env.PUBLISH_NPM_TOKEN }}
          NODE_AUTH_TOKEN: ${{ env.PUBLISH_NODE_AUTH_TOKEN }}
          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
          LEFTHOOK: 0

      - name: Create GitHub Release
        if: steps.changesets.outputs.published == 'true'
        uses: actions/create-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: v${{ fromJson(steps.changesets.outputs.publishedPackages)[0].version }}
          release_name: Release v${{ fromJson(steps.changesets.outputs.publishedPackages)[0].version }}
          body: |
            ## Changes

            ${{ steps.changesets.outputs.publishedPackages }}

            See CHANGELOG.md files in each package for detailed changes.
          draft: false
          prerelease: false

      - name: Summary
        if: steps.changesets.outputs.published == 'true'
        run: |
          echo "### Published Packages" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo '${{ steps.changesets.outputs.publishedPackages }}' | jq -r '.[] | "- \(.name)@\(.version)"' >> $GITHUB_STEP_SUMMARY

      - name: Verify published dependency closure
        if: steps.changesets.outputs.published == 'true'
        env:
          PUBLISHED_PACKAGES_JSON: ${{ steps.changesets.outputs.publishedPackages }}
        run: node scripts/check-published-closure.mjs

      - name: Notify Slack on Successful Publish
        if: steps.changesets.outputs.published == 'true'
        continue-on-error: true
        uses: slackapi/slack-github-action@v1.27.0
        with:
          payload: |
            {
              "text": "📦 PIE QTI Package Published to NPM",
              "blocks": [
                {
                  "type": "header",
                  "text": {
                    "type": "plain_text",
                    "text": "📦 NPM Package Published"
                  }
                },
                {
                  "type": "section",
                  "fields": [
                    {
                      "type": "mrkdwn",
                      "text": "*Repository:*\n${{ github.repository }}"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Version:*\nv${{ fromJson(steps.changesets.outputs.publishedPackages)[0].version }}"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Branch:*\n${{ github.ref_name }}"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Commit:*\n<${{ github.event.head_commit.url }}|${{ github.sha }}>"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Workflow:*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View Run>"
                    }
                  ]
                }
              ]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

      - name: Notify Slack on Release Failure
        if: failure()
        continue-on-error: true
        uses: slackapi/slack-github-action@v1.27.0
        with:
          payload: |
            {
              "text": "❌ PIE QTI Release Failed",
              "blocks": [
                {
                  "type": "header",
                  "text": {
                    "type": "plain_text",
                    "text": "❌ NPM Release Failed"
                  }
                },
                {
                  "type": "section",
                  "fields": [
                    {
                      "type": "mrkdwn",
                      "text": "*Repository:*\n${{ github.repository }}"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Branch:*\n${{ github.ref_name }}"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Commit:*\n<${{ github.event.head_commit.url }}|${{ github.sha }}>"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Author:*\n${{ github.event.head_commit.author.name }}"
                    },
                    {
                      "type": "mrkdwn",
                      "text": "*Workflow:*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View Run>"
                    }
                  ]
                }
              ]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK