release-sdk.yml

# Auto-releases SDK on push to:
# - main (@next channel)
# - stable (@latest channel)
# Also supports manual dispatch as a fallback for one-off releases.
name: "\U0001F4E6 Release SDK"

on:
  push:
    branches:
      - main
      - stable
    paths:
      # Keep in sync with packages/sdk/.releaserc.cjs includePaths (patch-commit-filter).
      - 'packages/sdk/**'
      - 'apps/cli/**'
      - 'packages/document-api/**'
      - 'packages/superdoc/**'
      - 'packages/super-editor/**'
      - 'packages/layout-engine/**'
      - 'packages/ai/**'
      - 'packages/word-layout/**'
      - 'packages/preset-geometry/**'
      - 'scripts/semantic-release/**'
      - 'pnpm-workspace.yaml'
      - '!**/*.md'
  workflow_dispatch:
    inputs:
      version:
        description: "Version to release (e.g. 1.0.0-next.7). Leave empty to publish the current repo version."
        required: false
        type: string
      dry-run:
        description: "Dry run — build and validate without publishing"
        required: false
        type: boolean
        default: false
      npm-tag:
        description: "npm dist-tag for Node SDK publish (e.g. latest, next). Only used for manual version override."
        required: false
        type: string
        default: latest

permissions:
  contents: write
  packages: write
  id-token: write # PyPI trusted publishing (OIDC)

concurrency:
  group: ${{ github.ref_name == 'stable' && 'release-stable-writeback' || format('{0}-{1}', github.workflow, github.ref) }}
  cancel-in-progress: ${{ github.ref_name != 'stable' }}

jobs:
  # -------------------------------------------------------------------
  # Auto-release via semantic-release (push trigger)
  # -------------------------------------------------------------------
  auto-release:
    if: github.event_name == 'push'
    runs-on: ubuntu-24.04
    environment: pypi
    outputs:
      released: ${{ steps.detect.outputs.released }}
      version: ${{ steps.detect.outputs.version }}
    steps:
      - name: Generate token
        id: generate_token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}

      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          token: ${{ steps.generate_token.outputs.token }}

      - name: Refresh stable branch head
        if: github.ref_name == 'stable'
        run: |
          git fetch origin "${{ github.ref_name }}" --tags
          git checkout -B "${{ github.ref_name }}" "origin/${{ github.ref_name }}"

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v6
        with:
          node-version-file: .nvmrc
          cache: pnpm
          registry-url: "https://registry.npmjs.org"

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.12

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install canvas system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            build-essential libcairo2-dev libpango1.0-dev \
            libjpeg-dev libgif-dev librsvg2-dev libpixman-1-dev

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Install Python build tools
        run: pip install build

      - name: Build packages
        run: pnpm run build

      - name: Snapshot tags before release
        id: tags_before
        run: echo "tags=$(git tag --list 'sdk-v*' | sort | tr '\n' ',')" >> "$GITHUB_OUTPUT"

      - name: Run semantic-release
        env:
          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          LINEAR_TOKEN: ${{ secrets.LINEAR_TOKEN }}
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        working-directory: packages/sdk
        run: pnpx semantic-release

      - name: Detect whether a release was created
        id: detect
        run: |
          BEFORE="${{ steps.tags_before.outputs.tags }}"
          AFTER=$(git tag --list 'sdk-v*' | sort | tr '\n' ',')
          RELEASE_TAG=$(git tag --points-at HEAD --list 'sdk-v*' --sort=-version:refname | head -n 1)
          if [ -z "$RELEASE_TAG" ]; then
            echo "release_present=false" >> "$GITHUB_OUTPUT"
            echo "released=false" >> "$GITHUB_OUTPUT"
            echo "version=" >> "$GITHUB_OUTPUT"
            echo "dist_tag=" >> "$GITHUB_OUTPUT"
            echo "No SDK release tag at HEAD."
          else
            echo "release_present=true" >> "$GITHUB_OUTPUT"
            if [ "$BEFORE" = "$AFTER" ]; then
              echo "released=false" >> "$GITHUB_OUTPUT"
            else
              echo "released=true" >> "$GITHUB_OUTPUT"
            fi
            VERSION="${RELEASE_TAG#sdk-v}"
            if [[ "$VERSION" == *-next.* ]]; then
              DIST_TAG="next"
            else
              DIST_TAG="latest"
            fi
            echo "version=$VERSION" >> "$GITHUB_OUTPUT"
            echo "dist_tag=$DIST_TAG" >> "$GITHUB_OUTPUT"
            if [ "$BEFORE" = "$AFTER" ]; then
              echo "SDK release tag already present at HEAD: $RELEASE_TAG"
            else
              echo "Released SDK v$VERSION"
            fi
          fi

      - name: Resume Node SDK publish for existing release tag
        if: steps.detect.outputs.release_present == 'true' && steps.detect.outputs.released != 'true'
        run: node packages/sdk/scripts/sdk-release-publish.mjs --tag "${{ steps.detect.outputs.dist_tag }}" --npm-only
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      # Build + publish Python whenever this commit corresponds to an SDK release
      - name: Build and verify Python SDK
        if: steps.detect.outputs.release_present == 'true'
        run: node packages/sdk/scripts/build-python-sdk.mjs

      - name: Publish companion Python packages to PyPI
        if: steps.detect.outputs.release_present == 'true'
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: packages/sdk/langs/python/companion-dist/
          skip-existing: true

      - name: Publish main Python SDK to PyPI
        if: steps.detect.outputs.release_present == 'true'
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: packages/sdk/langs/python/dist/
          skip-existing: true

  # -------------------------------------------------------------------
  # Sync labs agent with newly released SDK (main/@next only)
  # -------------------------------------------------------------------
  sync-labs-agent:
    needs: auto-release
    if: >-
      always()
      && github.event_name == 'push'
      && github.ref_name == 'main'
      && needs.auto-release.outputs.version != ''
    runs-on: ubuntu-24.04
    steps:
      - name: Generate token for superdoc-labs
        id: labs_token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          owner: superdoc-dev
          repositories: labs

      - name: Dispatch labs SDK update
        env:
          GH_TOKEN: ${{ steps.labs_token.outputs.token }}
        run: |
          VERSION="${{ needs.auto-release.outputs.version }}"
          echo "Dispatching update-agent-sdk.yml on superdoc-dev/labs main for @superdoc-dev/sdk@$VERSION"
          gh workflow run update-agent-sdk.yml \
            --repo superdoc-dev/labs \
            --ref main \
            --field sdk_version="$VERSION" \
            --field deploy_after_update=true

  # -------------------------------------------------------------------
  # Manual fallback (workflow_dispatch)
  # -------------------------------------------------------------------
  manual-release:
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-24.04
    environment: ${{ inputs.dry-run && '' || 'pypi' }}
    steps:
      - uses: actions/checkout@v6

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v6
        with:
          node-version-file: .nvmrc
          cache: pnpm
          registry-url: "https://registry.npmjs.org"

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.12

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Install Python build tools
        run: pip install build

      - name: Show current version
        run: |
          CURRENT=$(node -p "require('./packages/sdk/package.json').version")
          echo "### SDK Release (manual)" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| | Version |" >> $GITHUB_STEP_SUMMARY
          echo "|---|---|" >> $GITHUB_STEP_SUMMARY
          echo "| **Current (in repo)** | \`${CURRENT}\` |" >> $GITHUB_STEP_SUMMARY
          if [ -n "${{ inputs.version }}" ]; then
            echo "| **Releasing** | \`${{ inputs.version }}\` |" >> $GITHUB_STEP_SUMMARY
          else
            echo "| **Releasing** | \`${CURRENT}\` (unchanged) |" >> $GITHUB_STEP_SUMMARY
          fi
          echo "| **Dry run** | \`${{ inputs.dry-run }}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| **npm tag** | \`${{ inputs.npm-tag }}\` |" >> $GITHUB_STEP_SUMMARY

      - name: Set version
        if: inputs.version != ''
        run: node packages/sdk/scripts/sync-sdk-version.mjs --set "${{ inputs.version }}"

      - name: Generate all artifacts
        run: pnpm run generate:all

      - name: Build Node SDK
        run: pnpm --prefix packages/sdk/langs/node run build

      - name: Build superdoc package for CLI native bundling
        run: pnpm --prefix packages/superdoc run build:es

      - name: Verify superdoc build output exists
        run: |
          test -f packages/superdoc/dist/super-editor.es.js \
            || (echo "FATAL: packages/superdoc/dist/super-editor.es.js missing — build:es likely failed silently" && exit 1)

      - name: Validate SDK
        run: node packages/sdk/scripts/sdk-validate.mjs

      - name: Publish Node SDK packages (platforms + root)
        if: ${{ !inputs.dry-run }}
        run: node packages/sdk/scripts/sdk-release-publish.mjs --tag "${{ inputs.npm-tag }}" --npm-only
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Publish Node SDK packages (dry run)
        if: ${{ inputs.dry-run }}
        run: node packages/sdk/scripts/sdk-release-publish.mjs --tag "${{ inputs.npm-tag }}" --npm-only --dry-run

      - name: Build and verify Python SDK
        run: node packages/sdk/scripts/build-python-sdk.mjs

      - name: Publish companion Python packages to PyPI
        if: ${{ !inputs.dry-run }}
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: packages/sdk/langs/python/companion-dist/
          skip-existing: true

      - name: Publish main Python SDK to PyPI
        if: ${{ !inputs.dry-run }}
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: packages/sdk/langs/python/dist/
          skip-existing: true

      - name: Publish Python SDK (dry run)
        if: ${{ inputs.dry-run }}
        run: |
          echo "=== Companion wheels ==="
          ls -la packages/sdk/langs/python/companion-dist/
          echo "=== Root wheel ==="
          ls -la packages/sdk/langs/python/dist/