release.yml

name: Release

# Auto-release on a version bump: when a merge to main changes package.json and
# the version has no tag yet, gate → publish to npm → tag → GitHub release.
# So the release flow is just "merge a version-bump PR". (INT-2270)
#
# Requires a repo secret NPM_TOKEN (npm automation token). GITHUB_TOKEN is
# provided automatically for the tag + release.

on:
  push:
    branches: [main]
    paths: ['package.json']
  workflow_dispatch:

permissions:
  contents: write

env:
  NODE_VERSION: '22'

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Resolve version and whether it is already released
        id: ver
        run: |
          VERSION=$(node -p "require('./package.json').version")
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          # Check both the git tag AND the npm registry — a version can reach npm
          # via a manual publish (e.g. npmrc token workaround) without this workflow
          # ever creating the tag, which used to make this check say "not released"
          # and then E403 on `npm publish` (3 consecutive failed runs, INT-2665).
          if git rev-parse "v$VERSION" >/dev/null 2>&1; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
            echo "v$VERSION already tagged — nothing to release."
          elif npm view "@intrect/openswarm@$VERSION" version >/dev/null 2>&1; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
            echo "$VERSION already on npm (published outside this workflow) — nothing to release."
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
            echo "Releasing v$VERSION."
          fi

      - uses: actions/setup-node@v4
        if: steps.ver.outputs.exists == 'false'
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
          registry-url: 'https://registry.npmjs.org'

      - if: steps.ver.outputs.exists == 'false'
        run: npm ci

      # Hard gates — a red one blocks the release. Tests promoted from advisory
      # to hard (INT-2271 resolved: full suite green, see CHANGELOG).
      - if: steps.ver.outputs.exists == 'false'
        run: npm run lint
      - if: steps.ver.outputs.exists == 'false'
        run: npm run typecheck
      - if: steps.ver.outputs.exists == 'false'
        run: npm run build
      - if: steps.ver.outputs.exists == 'false'
        run: npm test

      # Each mutating step below is idempotent. The `exists` gate is resolved once
      # at job start, but publish only runs ~2min later (after lint/build/test), so
      # a manual release (npmrc-token publish + `gh release create`) landing in that
      # window used to E403 the job even though the release actually succeeded — a
      # recurring failure (INT-2665, and again on v0.17.7). Re-checking right before
      # each mutation lets a raced-but-complete release finish green.
      - name: Publish to npm
        if: steps.ver.outputs.exists == 'false'
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          VERSION: ${{ steps.ver.outputs.version }}
        run: |
          if npm view "@intrect/openswarm@$VERSION" version >/dev/null 2>&1; then
            echo "@intrect/openswarm@$VERSION already on npm — skipping publish."
          else
            npm publish --access public
          fi

      - name: Tag and GitHub release
        if: steps.ver.outputs.exists == 'false'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ steps.ver.outputs.version }}
        run: |
          if git rev-parse "v$VERSION" >/dev/null 2>&1; then
            echo "v$VERSION already tagged — skipping tag."
          else
            git tag "v$VERSION"
            git push origin "v$VERSION"
          fi
          if gh release view "v$VERSION" >/dev/null 2>&1; then
            echo "GitHub release v$VERSION already exists — skipping."
          else
            # Extract this version's CHANGELOG section for the release notes.
            NOTES=$(awk -v v="## $VERSION" '$0 ~ "^"v" " {f=1; next} /^## / {f=0} f' CHANGELOG.md)
            if [ -z "$NOTES" ]; then NOTES="Release v$VERSION"; fi
            gh release create "v$VERSION" --title "v$VERSION" --notes "$NOTES"
          fi