manual-release.yml

name: Manual Release
run-name: Production Release ${{ github.ref_name }} (pushed by ${{ github.actor }})

env:
  IMAGE_NAME: ghcr.io/herodevs/eol-scan

on:
  push:
    tags:
      - v*
permissions:
  contents: read

jobs:
  check-version:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
      - uses: ./.github/actions/verify-version
        id: verify-version
      - name: Verify tag matches version
        run: |
          VERSION=${{ steps.verify-version.outputs.version }}
          TAG_VERSION=${GITHUB_REF#refs/tags/v}
          if [ "$VERSION" != "$TAG_VERSION" ]; then
            echo "Error: Package version ($VERSION) does not match tag version ($TAG_VERSION)"
            exit 1
          fi
      - name: Determine Oclif channel
        id: determine-oclif-channel
        run: |
          VERSION=${{ steps.verify-version.outputs.version }}
          if [[ "$VERSION" == *"-beta"* ]]; then
            echo "oclif_channel=beta" >> $GITHUB_OUTPUT
          elif [[ "$VERSION" == *"-alpha"* ]]; then
            echo "oclif_channel=alpha" >> $GITHUB_OUTPUT
          elif [[ "$VERSION" == *"-next"* ]]; then
            echo "oclif_channel=next" >> $GITHUB_OUTPUT
          else
            echo "oclif_channel=latest" >> $GITHUB_OUTPUT
          fi
    outputs:
      version: ${{ steps.verify-version.outputs.version }}
      oclif_channel: ${{ steps.determine-oclif-channel.outputs.oclif_channel }}

  test:
    runs-on: ubuntu-latest
    needs: check-version
    env:
      GRAPHQL_HOST: ${{ secrets.GRAPHQL_HOST }}
      EOL_REPORT_URL: ${{ secrets.EOL_REPORT_URL }}
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
      - run: npm ci
      - run: npm run build
      - run: npm test
      - run: npm run test:e2e

  upload-assets:
    runs-on: ubuntu-latest
    needs: [check-version, test]
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
          registry-url: 'https://registry.npmjs.org'

      # Build
      - run: npm ci
      - run: npm run build

      # Build platform-specific tarballs
      - name: Install linux toolchain
        run: |
          sudo apt update
          sudo apt install nsis p7zip-full p7zip-rar -y

      - name: Build all tarballs in parallel
        run: |
          npx oclif pack tarballs --targets=linux-x64,win32-x64,darwin-arm64 --no-xz --parallel

      # Create GitHub Release (draft - will be published manually from GitHub UI or CLI)
      - name: Create GitHub Release
        run: |
          gh release create v${{ needs.check-version.outputs.version }} \
            --title "Release v${{ needs.check-version.outputs.version }} ${{ needs.check-version.outputs.oclif_channel == 'latest' && 'Latest' || needs.check-version.outputs.oclif_channel }}" \
            --generate-notes \
            --draft \
            --prerelease=${{ needs.check-version.outputs.oclif_channel != 'latest' }} \
            dist/*.tar.gz
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      # S3 Distribution
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ vars.aws_oidc_role_arn }}
          role-session-name: herodevs_cli_upload
          aws-region: ${{ vars.AWS_REGION }}


      - name: Upload and promote to S3
        run: |
          # Enable oclif debug logging
          export DEBUG=oclif:*

          # Upload tarballs
          npx oclif upload tarballs \
            --targets=linux-x64,win32-x64,darwin-arm64 \
            --no-xz

          # Get shortened SHA (first 7 characters)
          SHORT_SHA=$(echo ${{ github.sha }} | cut -c1-7)
          echo "Using shortened SHA: $SHORT_SHA"

          # Promote to channel
          npx oclif promote \
            --channel=${{ needs.check-version.outputs.oclif_channel }} \
            --version=${{ needs.check-version.outputs.version }} \
            --sha=$SHORT_SHA \
            --indexes \
            --targets=linux-x64,win32-x64,darwin-arm64 \
            --ignore-missing

  npm-publish:
    runs-on: ubuntu-latest
    needs: [check-version, test, upload-assets]
    permissions:
      id-token: write
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
          registry-url: 'https://registry.npmjs.org'

      # Clean build for npm publishing
      - run: npm ci
      - run: npm run build

      # Dry run NPM publish
      - name: Dry run NPM publish
        run: npm publish --tag ${{ needs.check-version.outputs.oclif_channel }} --provenance --access public --dry-run
        env:
          NODE_AUTH_TOKEN: ${{ secrets.HD_CLI_NPM_TOKEN }}

      # NPM Release
      - name: Create NPM release
        run: npm publish --tag ${{ needs.check-version.outputs.oclif_channel }} --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.HD_CLI_NPM_TOKEN }}

  publish-images:
    name: Publish Images
    needs: [npm-publish]
    runs-on: ubuntu-latest
    permissions:
      packages: write
    steps:
      - uses: actions/checkout@v6

      - uses: jlumbroso/free-disk-space@main
        with:
          tool-cache: true
          large-packages: true
          haskell: false
          docker-images: false
          swap-storage: false
      
      - name: Set up Node
        uses: actions/setup-node@v6.1.0
        with:
          node-version-file: '.nvmrc'

      - name: Parse tag
        run: echo "VERSION=${{ github.ref_name }}" >> $GITHUB_ENV

      - uses: docker/metadata-action@v5
        id: meta
        with:
          images: |
            name=${{ env.IMAGE_NAME }}
          tags: |
            type=sha,format=long
            type=raw,value=latest
            type=raw,value=${{ env.VERSION }}

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: docker/setup-buildx-action@v3
      - uses: docker/build-push-action@v6
        with:
          context: . 
          file: ./ci/image.Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            VERSION=${{ needs.check-version.outputs.version }}