release.yaml

name: Release

# The npm-publish workflow for @legioncodeinc/cli-kit. Uses OIDC Trusted
# Publishing (no NPM_TOKEN) — the same pattern as honeycomb, doctor, hive, and
# nectar. GitHub Actions presents a short-lived OIDC identity that npm verifies
# against the trusted publisher configured on the @legioncodeinc/cli-kit package.
#
# AUTH: npm TRUSTED PUBLISHING (OIDC) — no long-lived automation token.
# Provenance stays ON. Trusted Publishing REQUIRES npm >= 11.5.1, which Node 22
# does NOT ship — see the "Upgrade npm" step.
#
# BOOTSTRAP: the first publish is a one-time MANUAL publish (2FA) to create the
# package on the registry, then the npm trusted-publisher is configured. Every
# subsequent CI publish from a pushed vX.Y.Z tag is tokenless.
#
# Two ways in:
#   * push a version tag v* -> a real publish attempt (still gated).
#   * workflow_dispatch with dry_run -> rehearse without publishing.

on:
  push:
    tags: ['v*']
  workflow_dispatch:
    inputs:
      dry_run:
        description: 'Rehearse only: run the gate + npm publish --dry-run, never publish.'
        type: boolean
        required: false
        default: true

concurrency:
  group: release-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: write
  id-token: write

jobs:
  release:
    name: Publish cli-kit to npm
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4.2.2
        with:
          persist-credentials: false

      - name: Setup Node
        uses: actions/setup-node@v6.4.0
        with:
          node-version: '22.x'
          registry-url: 'https://registry.npmjs.org'

      - name: Upgrade npm (Trusted Publishing needs npm >= 11.5.1)
        run: npm install -g npm@11.6.2

      - name: Enable OIDC trusted publishing (strip scaffolded auth token)
        run: |
          npmrc="${NPM_CONFIG_USERCONFIG:-$HOME/.npmrc}"
          if [ -f "$npmrc" ]; then
            sed -i '/:_authToken=/d' "$npmrc"
          fi
          echo "npm version: $(npm --version)"
          echo "registry:    $(npm config get registry)"

      - name: Install (npm ci)
        run: npm ci

      - name: Typecheck
        run: npm run typecheck

      - name: Test
        run: npm run test

      - name: Build (tsc)
        run: npm run build

      - name: Generate CycloneDX SBOM
        run: npx --yes @cyclonedx/cyclonedx-npm@4.1.1 --omit dev --output-file cli-kit-${{ github.ref_name }}.cdx.json --spec-version 1.6

      - name: Guard - pushed tag matches package.json version
        if: ${{ github.ref_type == 'tag' }}
        run: |
          PKG_VERSION="$(node -p "require('./package.json').version")"
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          echo "package.json version: $PKG_VERSION"
          echo "pushed tag:           $GITHUB_REF_NAME (-> $TAG_VERSION)"
          if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then
            echo "::error::Tag/version mismatch: tag '$GITHUB_REF_NAME' implies version '$TAG_VERSION' but package.json is '$PKG_VERSION'."
            exit 1
          fi
          echo "OK — tag and package.json agree on $PKG_VERSION"

      - name: Preflight — publishability (version + scoped-name guard)
        run: |
          PKG_VERSION="$(node -p "require('./package.json').version")"
          PKG_NAME="$(node -p "require('./package.json').name")"
          echo "name:    $PKG_NAME"
          echo "version: $PKG_VERSION"
          FAIL=0
          if [ "$PKG_VERSION" = "0.0.0" ]; then
            echo "::error::package.json version is the 0.0.0 not-cut-yet sentinel."
            FAIL=1
          fi
          if [ "$PKG_NAME" != "@legioncodeinc/cli-kit" ]; then
            echo "::error::package.json name is '$PKG_NAME', expected '@legioncodeinc/cli-kit'."
            FAIL=1
          fi
          if [ "$FAIL" = "1" ]; then
            echo "Refusing to publish: the go-live conditions have not all been met."
            exit 1
          fi
          echo "OK — package is publishable."

      - name: Resolve publish mode
        id: mode
        env:
          EVENT_NAME: ${{ github.event_name }}
          REF_TYPE: ${{ github.ref_type }}
          DRY_RUN_INPUT: ${{ github.event.inputs.dry_run }}
        run: |
          if [ "$EVENT_NAME" = "push" ] && [ "$REF_TYPE" = "tag" ] && [ "$DRY_RUN_INPUT" != "true" ]; then
            echo "publish=true" >> "$GITHUB_OUTPUT"
            echo "Mode: REAL publish (pushed tag)."
          else
            echo "publish=false" >> "$GITHUB_OUTPUT"
            echo "Mode: DRY-RUN."
          fi

      - name: Check whether this version is already on npm
        id: npm_version
        if: ${{ steps.mode.outputs.publish == 'true' }}
        run: |
          PKG_NAME="$(node -p "require('./package.json').name")"
          PKG_VERSION="$(node -p "require('./package.json').version")"
          set +e
          VIEW_OUTPUT="$(npm view "$PKG_NAME@$PKG_VERSION" version --json 2>&1)"
          STATUS=$?
          set -e
          if [ "$STATUS" -eq 0 ]; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
          elif echo "$VIEW_OUTPUT" | grep -q 'E404'; then
            echo "exists=false" >> "$GITHUB_OUTPUT"
          else
            echo "::error::npm view failed with a non-404 error."
            echo "$VIEW_OUTPUT"
            exit "$STATUS"
          fi

      - name: Publish (real)
        if: ${{ steps.mode.outputs.publish == 'true' && steps.npm_version.outputs.exists != 'true' }}
        run: npm publish --provenance --access public

      - name: Publish (dry-run rehearsal)
        if: ${{ steps.mode.outputs.publish != 'true' }}
        run: npm publish --provenance --access public --dry-run

      - name: Install Bedrock SDK (release notes)
        if: ${{ github.ref_type == 'tag' && steps.mode.outputs.publish == 'true' }}
        run: npm i --no-save --ignore-scripts @aws-sdk/client-bedrock-runtime

      - name: Generate release notes (Sonnet 5 on Bedrock)
        if: ${{ github.ref_type == 'tag' && steps.mode.outputs.publish == 'true' }}
        env:
          AWS_BEARER_TOKEN_BEDROCK: ${{ secrets.AWS_BEDROCK_API_KEY }}
          AWS_REGION: ${{ vars.AWS_REGION }}
          BEDROCK_MODEL_ID: ${{ vars.BEDROCK_MODEL_ID }}
          RELEASE_VERSION: ${{ github.ref_name }}
        run: node scripts/release/ai-release-notes.mjs

      - name: Create GitHub Release
        if: ${{ github.ref_type == 'tag' && steps.mode.outputs.publish == 'true' }}
        uses: softprops/action-gh-release@v2.4.1
        with:
          tag_name: ${{ github.ref_name }}
          name: ${{ github.ref_name }}
          body_path: RELEASE_NOTES.md
          files: cli-kit-${{ github.ref_name }}.cdx.json

      - name: Announce on Discord
        if: ${{ github.ref_type == 'tag' && steps.mode.outputs.publish == 'true' }}
        env:
          DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
          RELEASE_VERSION: ${{ github.ref_name }}
        run: node scripts/release/discord-notify.mjs