release.yml

# Build bundled Cheater_Detection.lua + local HTTP bridge, tag with auto version bump, publish GitHub Release.
# No workflow artifacts are uploaded (release assets only) to limit Actions storage use.

name: Release

on:
  push:
    branches:
      - main

concurrency:
  group: release-${{ github.repository }}
  cancel-in-progress: true

permissions:
  contents: write
  actions: write

jobs:
  release:
    if: >-
      github.event_name == 'push' &&
      github.ref == 'refs/heads/main' &&
      !contains(github.event.head_commit.message, '[skip release]')
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Compute next version tag
        id: version
        shell: bash
        env:
          COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
        run: |
          set -euo pipefail
          # Semver bump from first line of commit message (priority: major > minor > patch).
          # patch (+0.0.1): fix, perf, patch, hotfix, … — default when no keyword matches.
          # minor (+0.1.0): minor, feat, feature, update
          # major (+1.0.0): major, breaking, break
          msg="$(printf '%s' "${COMMIT_MESSAGE}" | head -n1 | tr '[:upper:]' '[:lower:]')"
          bump="patch"
          if [[ "${msg}" =~ (^|[^a-z])(major|breaking|break)([^a-z]|$) ]]; then
            bump="major"
          elif [[ "${msg}" =~ (^|[^a-z])(minor|feature|feat|update)([^a-z]|$) ]]; then
            bump="minor"
          elif [[ "${msg}" =~ (^|[^a-z])(patch|fix|perf|hotfix)([^a-z]|$) ]]; then
            bump="patch"
          fi

          latest_tag="$(git tag -l 'v[0-9]*' --sort=-v:refname | head -n1 || true)"
          if [[ -z "${latest_tag}" ]]; then
            major=1
            minor=0
            patch=0
          else
            ver="${latest_tag#v}"
            if [[ "${ver}" =~ ^[0-9]+\.[0-9]+$ ]]; then
              IFS='.' read -r major minor <<< "${ver}"
              patch=0
            else
              IFS='.' read -r major minor patch _ <<< "${ver}."
              major="${major:-0}"
              minor="${minor:-0}"
              patch="${patch:-0}"
            fi
          fi

          case "${bump}" in
            major)
              major=$((major + 1))
              minor=0
              patch=0
              ;;
            minor)
              minor=$((minor + 1))
              patch=0
              ;;
            patch)
              patch=$((patch + 1))
              ;;
          esac

          next="v${major}.${minor}.${patch}"
          echo "latest=${latest_tag:-none}" >> "$GITHUB_OUTPUT"
          echo "tag=${next}" >> "$GITHUB_OUTPUT"
          echo "bump=${bump}" >> "$GITHUB_OUTPUT"
          echo "Next release tag: ${next} (${bump} bump, previous: ${latest_tag:-none})"

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install Node dependencies
        run: npm ci

      - name: Rebuild embedded databases
        run: python external_sources/rebuild_embedded_databases.py

      - name: Bundle Lua
        env:
          BUNDLE_CI: "1"
          BUNDLE_OUTPUT_PATH: ${{ github.workspace }}/dist/Cheater_Detection.lua
        run: npm run bundle

      - name: Stage release files
        run: |
          set -euo pipefail
          mkdir -p dist
          test -s dist/Cheater_Detection.lua
          cp LocalBridge/local_http_bridge_server.py dist/local_http_bridge_server.py
          sha256sum dist/Cheater_Detection.lua dist/local_http_bridge_server.py > dist/SHA256SUMS.txt

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          tag="${{ steps.version.outputs.tag }}"
          bump="${{ steps.version.outputs.bump }}"
          short_sha="${GITHUB_SHA::7}"
          body_file="$(mktemp)"
          {
            echo "Automated release for commit [\`${short_sha}\`](${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/commit/${GITHUB_SHA}) (**${bump}** bump → \`${tag}\`)."
            echo ""
            echo "### Assets"
            echo "- \`Cheater_Detection.lua\` — bundled Lmaobox script (load from \`%localappdata%/lua/\`)"
            echo "- \`local_http_bridge_server.py\` — optional localhost HTTP bridge"
            echo "- \`SHA256SUMS.txt\` — checksums"
            echo ""
            echo "### Install"
            echo "1. Download \`Cheater_Detection.lua\` from this release."
            echo "2. Place it in \`%localappdata%/lua/Cheater_Detection.lua\`."
            echo "3. (Optional) Run \`local_http_bridge_server.py\` with Python 3 for async lookups."
          } > "${body_file}"
          gh release create "${tag}" \
            --title "${tag}" \
            --notes-file "${body_file}" \
            dist/Cheater_Detection.lua \
            dist/local_http_bridge_server.py \
            dist/SHA256SUMS.txt

      - name: Purge workflow artifacts
        uses: actions/github-script@v7
        with:
          script: |
            const { owner, repo } = context.repo;
            let page = 1;
            let deleted = 0;
            for (;;) {
              const { data } = await github.rest.actions.listArtifactsForRepo({
                owner,
                repo,
                per_page: 100,
                page,
              });
              if (data.artifacts.length === 0) {
                break;
              }
              for (const artifact of data.artifacts) {
                await github.rest.actions.deleteArtifact({
                  owner,
                  repo,
                  artifact_id: artifact.id,
                });
                deleted += 1;
              }
              if (data.artifacts.length < 100) {
                break;
              }
              page += 1;
            }
            core.info(`Deleted ${deleted} workflow artifact(s).`);