release.yml

name: Release

# Pushing a v* tag publishes a GitHub Release with the packed ds-bot, social and tree
# tarballs and that version's CHANGELOG.md section. It waits for the Test run on the tagged
# commit to pass first. Only GITHUB_TOKEN is used.
# Normally the tag must match core/package.json's version; an allowlisted product tag may
# differ when CHANGELOG.md documents the current core pin. Packing still uses each package's
# own package.json version, and the release notes come from CHANGELOG's [VERSION] section.

on:
  push:
    tags: ['v*']
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release (e.g. 0.1.6, no v prefix; the v tag must exist)'
        required: true
        type: string

permissions:
  contents: read

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest
    timeout-minutes: 75
    permissions:
      contents: write
      actions: read
    env:
      GH_TOKEN: ${{ github.token }}
      INPUT_VERSION: ${{ inputs.version }}
    steps:
      - name: Version
        id: version
        run: |
          if [[ "$GITHUB_REF" == refs/tags/* ]]; then VERSION="${GITHUB_REF_NAME#v}"; else VERSION="$INPUT_VERSION"; fi
          # a newline or quote would add outputs
          [[ "$VERSION" =~ ^[0-9][0-9A-Za-z.+-]*$ ]] || { echo "bad version: $VERSION" >&2; exit 1; }
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "ref=v$VERSION" >> "$GITHUB_OUTPUT"
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          ref: ${{ steps.version.outputs.ref }}
          persist-credentials: false
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
        with:
          node-version: 24
          # No cache in a job that publishes: nothing restored from a cache goes into a release.
          package-manager-cache: false
      - name: Tag matches core/package.json (or is an allowlisted product tag)
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: node .github/scripts/check-release-version.mjs "$VERSION"
      - name: Wait for a green Test run on this commit
        run: |
          sha=$(git rev-parse HEAD)
          for i in $(seq 1 120); do
            c=$(gh run list -R "$GITHUB_REPOSITORY" --workflow Test --commit "$sha" --json status,conclusion \
              -q '[.[] | select(.status == "completed")] | map(.conclusion) | if any(. == "success") then "success" elif length > 0 and all(. != "success") then "failure" else "" end')
            echo "attempt $i: ${c:-pending}"
            [ "$c" = success ] && exit 0
            [ "$c" = failure ] && { echo "Test failed on $sha" >&2; exit 1; }
            sleep 30
          done
          echo "no completed Test run on $sha" >&2; exit 1
      - name: Pack
        run: node .github/scripts/check-pack.mjs dist
      - name: Publish the release
        env:
          VERSION: ${{ steps.version.outputs.version }}
          REF: ${{ steps.version.outputs.ref }}
        run: |
          set -euo pipefail
          node .github/scripts/release-notes.mjs "$VERSION" > notes.md
          if gh release view "$REF" -R "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            gh release edit "$REF" -R "$GITHUB_REPOSITORY" --notes-file notes.md
            gh release upload "$REF" dist/*.tgz -R "$GITHUB_REPOSITORY" --clobber
          else
            gh release create "$REF" dist/*.tgz -R "$GITHUB_REPOSITORY" --verify-tag --title "FlyBot $REF" --notes-file notes.md
          fi