release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Release version (e.g. 0.1.0, without v prefix)'
        required: true
      ref:
        description: 'Git ref to release. Defaults to main.'
        required: false
        default: 'main'

env:
  GORELEASER_VERSION: v2.14.3

permissions:
  contents: write

concurrency:
  group: prepare-release-${{ inputs.version }}
  cancel-in-progress: false

jobs:
  validate:
    uses: ./.github/workflows/reusable-validate-release.yml
    with:
      version: ${{ inputs.version }}
      ref: ${{ inputs.ref }}

  go-checks:
    needs: validate
    uses: ./.github/workflows/reusable-go.yml
    with:
      ref: ${{ needs.validate.outputs.sha }}

  npm-checks:
    needs: validate
    uses: ./.github/workflows/reusable-npm.yml
    with:
      ref: ${{ needs.validate.outputs.sha }}
      version: ${{ needs.validate.outputs.version }}

  e2e:
    needs: validate
    uses: ./.github/workflows/reusable-e2e.yml
    with:
      timeout-minutes: 20

  publish-dry-run:
    name: GoReleaser Dry Run
    needs: validate
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          ref: ${{ needs.validate.outputs.sha }}

      - uses: actions/setup-go@v6
        with:
          go-version: '1.26'

      - name: Run GoReleaser snapshot
        run: |
          curl -sfL https://goreleaser.com/static/run | VERSION="$GORELEASER_VERSION" bash -s -- release --clean --snapshot
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}

      - name: Dry-run npm publish
        working-directory: npm
        run: |
          CURRENT="$(jq -r .version package.json)"
          DESIRED="${{ needs.validate.outputs.version }}"
          if [ "$CURRENT" != "$DESIRED" ]; then
            npm version "$DESIRED" --no-git-tag-version
          else
            echo "Version already correct: $CURRENT"
          fi
          npm publish --dry-run

  approval:
    name: Manual Approval
    needs:
      - validate
      - go-checks
      - npm-checks
      - e2e
      - publish-dry-run
    if: >-
      always() && !cancelled()
      && needs.validate.result == 'success'
      && needs.go-checks.result == 'success'
      && needs.publish-dry-run.result == 'success'
    runs-on: ubuntu-latest
    environment:
      name: release-approval
    steps:
      - name: Report check results
        run: |
          echo "## Pre-Release Check Results" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "| Check | Status |" >> "$GITHUB_STEP_SUMMARY"
          echo "|-------|--------|" >> "$GITHUB_STEP_SUMMARY"
          echo "| Go | ✅ |" >> "$GITHUB_STEP_SUMMARY"
          echo "| npm | ${{ needs.npm-checks.result == 'success' && '✅' || '⚠️ ' }}${{ needs.npm-checks.result }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| E2E | ${{ needs.e2e.result == 'success' && '✅' || '⚠️ ' }}${{ needs.e2e.result }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| GoReleaser dry run | ✅ |" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "Release candidate: **${{ needs.validate.outputs.tag }}** at \`${{ needs.validate.outputs.sha }}\`" >> "$GITHUB_STEP_SUMMARY"

  create-tag:
    name: Create Release Tag
    needs:
      - validate
      - approval
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          ref: ${{ needs.validate.outputs.sha }}

      - name: Create and push tag
        run: |
          TAG="${{ needs.validate.outputs.tag }}"

          if git ls-remote --exit-code --tags origin "refs/tags/$TAG" >/dev/null 2>&1; then
            echo "tag $TAG already exists on origin" >&2
            exit 1
          fi

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git tag -a "$TAG" -m "Release $TAG"
          git push origin "refs/tags/$TAG"

      - name: Summarize
        run: |
          echo "## Release Tag Created" >> "$GITHUB_STEP_SUMMARY"
          echo "- Tag: ${{ needs.validate.outputs.tag }}" >> "$GITHUB_STEP_SUMMARY"
          echo "- Commit: \`${{ needs.validate.outputs.sha }}\`" >> "$GITHUB_STEP_SUMMARY"

  publish:
    name: Publish Release
    needs:
      - validate
      - create-tag
    permissions:
      contents: write
    uses: ./.github/workflows/reusable-release-publish.yml
    with:
      ref: refs/tags/${{ needs.validate.outputs.tag }}
      tag: ${{ needs.validate.outputs.tag }}
    secrets: inherit