release.yml

name: CI

on:
  push:
    branches: [ main ]
    paths-ignore:
      - "**.md"
      - "docs/**"
      - ".github/instructions/**"
  workflow_dispatch:
    inputs:
      force_bump:
        description: "Force a version bump type (bypasses conventional commits).
          Defaults to 'minor' on manual dispatch."
        required: false
        default: minor
        type: choice
        options:
          - minor
          - patch
          - major

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  ci:
    runs-on: ubuntu-latest
    if: "!contains(github.event.head_commit.message, '[skip ci]') &&
      !contains(github.event.head_commit.message, 'chore(release)')"

    permissions:
      contents: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup CI environment
        uses: ./.github/actions/setup

      - name: Compute affected projects
        id: affected
        run: |
          NX_BASE=$(git describe --tags --abbrev=0 2>/dev/null || git rev-list --max-parents=0 HEAD)
          echo "nx-base=${NX_BASE}" >> "$GITHUB_OUTPUT"
          AFFECTED=$(pnpm nx show projects --affected --base="${NX_BASE}" --json 2>/dev/null \
            | node -e "process.stdout.write(JSON.parse(require('fs').readFileSync('/dev/stdin','utf8')).join(' '))")
          echo "NX_AFFECTED_PROJECTS=${AFFECTED}" >> "$GITHUB_ENV"
          # Write JSON for debugging artifact
          pnpm nx show projects --affected --base="${NX_BASE}" --json 2>/dev/null > dist/nx-affected.json || true
          # Print to step summary for visibility
          {
            echo "## Affected Projects (base: \`${NX_BASE}\`)"
            echo '```'
            echo "${AFFECTED}" | tr ' ' '\n'
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Run tests
        env:
          CI: "true"
        run: |
          pnpm nx affected -t test \
            --base="${{ steps.affected.outputs.nx-base }}" --head=HEAD \
            --output-style=stream \
            --logger "console;verbosity=minimal" \
            --nxBail


      - name: Sync Codecov flags
        run: pnpm nx run tests:coverage:sync

      - name: Configure Git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Determine last published release tag
        id: last-published
        run: |
          # Find the most recent vX.Y.Z tag reachable from HEAD.
          # --merged HEAD ensures we never resolve to a tag on an orphaned branch,
          # which can happen when a release commit is pushed concurrently with other
          # work and the merge produces a non-linear ancestry.
          BASE_TAG=$(git tag --sort=-v:refname --merged HEAD \
            | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -1)
          if [ -z "$BASE_TAG" ]; then
            # No release tag yet — start from the initial commit.
            BASE_TAG=$(git rev-list --max-parents=0 HEAD)
          fi
          echo "tag=${BASE_TAG}" >> "$GITHUB_OUTPUT"
          echo "Base tag for release: ${BASE_TAG}"

      - name: Run NX Release (version + changelog + commit + tag)
        id: release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CI: "true"
        run: |
          OLD_VERSION=$(node -p "require('./package.json').version")
          FORCE_BUMP_FLAG=${{ inputs.force_bump && format('--force-bump={0}', inputs.force_bump) || '' }}
          node scripts/release.mjs --from="${{ steps.last-published.outputs.tag }}" ${FORCE_BUMP_FLAG}
          NEW_VERSION=$(node -p "require('./package.json').version")
          echo "version=$NEW_VERSION" >> "$GITHUB_OUTPUT"
          if [ "$OLD_VERSION" != "$NEW_VERSION" ]; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
            echo "Version bumped from $OLD_VERSION to $NEW_VERSION"
          else
            echo "changed=false" >> "$GITHUB_OUTPUT"
            echo "No version bump — skipping release."
          fi

      - name: Push release commit and tag
        if: steps.release.outputs.changed == 'true'
        run: git push --follow-tags

      - name: Create GitHub Release Draft
        if: steps.release.outputs.changed == 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION="v${{ steps.release.outputs.version }}"
          # Extract the changelog entry for this version
          NOTES=$(awk "/^## ${{ steps.release.outputs.version }}/{found=1;next} /^## /{if(found)exit} found{print}" CHANGELOG.md)
          gh release create "${VERSION}" \
            --title "${VERSION}" \
            --notes "${NOTES}" \
            --draft

      - name: Pack NuGet packages (release version)
        if: steps.release.outputs.changed == 'true'
        run: |
          # Remove any nupkgs left in dist/packages from the test run (e.g. Flowthru.Tests.Templates)
          # before packing to ensure only the newly-versioned packages are uploaded.
          rm -f dist/packages/*.nupkg
          pnpm nx run-many -t pack

      - name: Upload packages to GitHub release
        if: steps.release.outputs.changed == 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION="v${{ steps.release.outputs.version }}"
          gh release upload "${VERSION}" dist/packages/*.nupkg

      # - name: Install Copilot CLI
      #   if: steps.release.outputs.changed == 'true'
      #   run: npm install -g @github/copilot

      # - name: Generate release summary
      #   if: steps.release.outputs.changed == 'true'
      #   env:
      #     COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_CLI_TOKEN }}
      #   run: |
      #     HEAD_TAG="v${{ steps.release.outputs.version }}"
      #     BASE_TAG="${{ steps.last-published.outputs.tag }}"
      #     copilot -p "Generate a release summary. Base tag: ${BASE_TAG}, head tag: ${HEAD_TAG}. Summarize all changes between these two tags." \
      #       --agent=dev-relations \
      #       --model=claude-haiku-4.5 \
      #       --available-tools='view,create,edit,bash' \
      #       --allow-tool='shell(git:*)' \
      #       --allow-tool='write' \
      #       --allow-tool='view' \
      #       --add-dir=. \
      #       --deny-tool='shell(git push)' \
      #       --deny-tool='shell(git reset)' \
      #       --deny-tool='shell(git checkout)' \
      #       --deny-tool='shell(git commit)' \
      #       --deny-tool='shell(git merge)' \
      #       --deny-tool='shell(git rebase)' \
      #       --deny-tool='shell(git branch -d)' \
      #       --deny-tool='shell(git tag -d)' \
      #       --no-ask-user

      # - name: Prepend summary to draft release
      #   if: steps.release.outputs.changed == 'true'
      #   env:
      #     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      #   run: |
      #     VERSION="v${{ steps.release.outputs.version }}"
      #     SUMMARY_FILE="docs/scratch/release-${{ steps.release.outputs.version }}.md"
      #     if [ -f "$SUMMARY_FILE" ]; then
      #       EXISTING_NOTES=$(gh release view "${VERSION}" --json body -q '.body')
      #       {
      #         cat "$SUMMARY_FILE"
      #         echo ""
      #         echo "---"
      #         echo ""
      #         echo "$EXISTING_NOTES"
      #       } > /tmp/combined-notes.md
      #       gh release edit "${VERSION}" --notes-file /tmp/combined-notes.md
      #     fi

      - name: Publish preview to NuGet
        if: steps.release.outputs.changed == 'true'
        env:
          FLOWTHRU_NUGET_API_KEY: ${{ secrets.FLOWTHRU_NUGET_API_KEY }}
        run: |
          VERSION="${{ steps.release.outputs.version }}"
          PRERELEASE_VERSION="${VERSION}-preview.${{ github.run_number }}"
          rm dist/packages/*.nupkg
          # Scope to src/ only — examples and tests are not NuGet artifacts.
          # Directory.Build.props already restricts Version and PackageOutputPath
          # to src/ projects; this find mirrors that boundary explicitly.
          find src/ -name "*.csproj" -print0 | while IFS= read -r -d '' csproj; do
            dotnet pack "$csproj" \
              --no-build \
              -c Release \
              /p:Version="${PRERELEASE_VERSION}"
          done
          dotnet nuget push "dist/packages/*.nupkg" \
            --api-key "${FLOWTHRU_NUGET_API_KEY}" \
            --source https://api.nuget.org/v3/index.json \
            --skip-duplicate

      - name: Install Codecov CLI
        if: always()
        run: |
          curl https://keybase.io/codecovsecurity/pgp_keys.asc \
            | gpg --no-default-keyring --keyring trustedkeys.gpg --import
          curl -Os https://cli.codecov.io/latest/linux/codecov
          curl -Os https://cli.codecov.io/latest/linux/codecov.SHA256SUM
          curl -Os https://cli.codecov.io/latest/linux/codecov.SHA256SUM.sig
          gpg --no-default-keyring --keyring trustedkeys.gpg \
            --verify codecov.SHA256SUM.sig codecov.SHA256SUM
          shasum -a 256 -c codecov.SHA256SUM
          sudo chmod +x codecov
          sudo mv codecov /usr/local/bin/codecov

      - name: Upload coverage to Codecov
        if: always()
        continue-on-error: true
        env:
          CODECOV_TOKEN: ${{ secrets.FLOWTHRU_CODECOV_TOKEN }}
        run: pnpm nx run tests:coverage:upload