publish-release.yml

name: Publish Release

on:
  pull_request_target:
    branches: [main]
    types: [closed]
  workflow_dispatch:
    inputs:
      release_pr:
        description: 'Merged release PR number to recover or republish'
        required: true
        type: number

concurrency:
  group: publish-release-${{ inputs.release_pr || github.event.pull_request.number }}
  cancel-in-progress: false

jobs:
  publish-release:
    if: >-
      github.event_name == 'workflow_dispatch' ||
      (github.event.pull_request.merged == true &&
      startsWith(github.event.pull_request.head.ref, 'chore/release-v') &&
      endsWith(github.event.pull_request.user.login, '[bot]'))
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: read
      packages: write
    steps:
      - name: Generate bot token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ secrets.BOT_CLIENT_ID }}
          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}

      - name: Resolve and verify release PR
        id: release-pr
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          PR_NUMBER: ${{ inputs.release_pr || github.event.pull_request.number }}
        run: |
          set -euo pipefail
          PR=$(gh pr view "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --json author,headRefName,mergedAt,mergeCommit)
          IS_BOT=$(jq -r '.author.is_bot // false' <<<"$PR")
          HEAD_REF=$(jq -r '.headRefName' <<<"$PR")
          MERGED_AT=$(jq -r '.mergedAt // empty' <<<"$PR")
          MERGE_SHA=$(jq -r '.mergeCommit.oid // empty' <<<"$PR")
          if [ -z "$MERGED_AT" ] || [ -z "$MERGE_SHA" ] || [ "$IS_BOT" != "true" ] || [[ "$HEAD_REF" != chore/release-v* ]]; then
            echo "PR #$PR_NUMBER is not a merged bot-authored release PR"
            exit 1
          fi
          FILES=$(gh pr view "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --json files --jq '.files[].path' | sort)
          EXPECTED=$'package-lock.json\npackage.json'
          if [ "$FILES" != "$EXPECTED" ]; then
            echo "Release PR changed unexpected files:"
            echo "$FILES"
            exit 1
          fi
          echo "merge_sha=$MERGE_SHA" >> "$GITHUB_OUTPUT"

      - name: Checkout merged release
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ steps.release-pr.outputs.merge_sha }}
          fetch-depth: 0
          token: ${{ steps.app-token.outputs.token }}

      - name: Resolve and validate release metadata
        id: release
        env:
          PR_BODY: ${{ github.event.pull_request.body }}
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          PR_NUMBER: ${{ inputs.release_pr || github.event.pull_request.number }}
        run: |
          set -euo pipefail
          VERSION=$(jq -r .version package.json)
          LOCK_VERSION=$(jq -r .version package-lock.json)
          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$ ]] || [ "$LOCK_VERSION" != "$VERSION" ]; then
            echo "Version files do not contain matching semver values"
            exit 1
          fi
          if [ -z "$PR_BODY" ]; then
            PR_BODY=$(gh pr view "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --json body --jq .body)
          fi
          NOTES=$(printf '%s\n' "$PR_BODY" | sed -n '/<!-- release-notes -->/,$p' | tail -n +2)
          if [ -z "${NOTES//[[:space:]]/}" ]; then
            echo "Release notes are missing from the release PR"
            exit 1
          fi
          printf '%s\n' "$NOTES" > "$RUNNER_TEMP/release-notes.md"
          echo "tag=v$VERSION" >> "$GITHUB_OUTPUT"

      - name: Create tag at merge commit
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          MERGE_SHA: ${{ steps.release-pr.outputs.merge_sha }}
          TAG: ${{ steps.release.outputs.tag }}
        run: |
          set -euo pipefail
          if EXISTING_SHA=$(gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$TAG" --jq .object.sha 2>/dev/null); then
            if [ "$EXISTING_SHA" != "$MERGE_SHA" ]; then
              echo "Tag $TAG already points to $EXISTING_SHA"
              exit 1
            fi
          else
            gh api --method POST "repos/$GITHUB_REPOSITORY/git/refs" -f ref="refs/tags/$TAG" -f sha="$MERGE_SHA" >/dev/null
          fi

      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          TAG: ${{ steps.release.outputs.tag }}
        run: |
          set -euo pipefail
          if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            echo "Release $TAG already exists"
          else
            gh release create "$TAG" --repo "$GITHUB_REPOSITORY" --title "$TAG" --notes-file "$RUNNER_TEMP/release-notes.md"
          fi

      - name: Setup Helm
        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
        with:
          version: v4.2.3

      - name: Package and push Helm chart to OCI registry
        env:
          # The Actions token (not the app token): GHCR package creation is
          # scoped to the repo's own token — the app token 403s on the first
          # push of a new package (ghcr.io/misospace/charts/dispatch).
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ steps.release.outputs.tag }}
        run: |
          set -euo pipefail
          CHART_VERSION="${VERSION#v}"
          # Stamp Chart.yaml with the release version (runner-preinstalled
          # mikefarah yq — do NOT pip-install the python jq-wrapper yq, its
          # flags differ and it shadows the good one on PATH).
          yq -i ".version = \"${CHART_VERSION}\"" charts/dispatch/Chart.yaml
          yq -i ".appVersion = \"${CHART_VERSION}\"" charts/dispatch/Chart.yaml
          helm repo add bjw-s-labs https://bjw-s-labs.github.io/helm-charts
          helm dependency build charts/dispatch
          helm package charts/dispatch --destination /tmp/charts
          # Native OCI push (helm >= 3.8) — no chartmuseum plugin needed.
          helm registry login ghcr.io --username "${GITHUB_ACTOR}" --password-stdin <<< "${GH_TOKEN}"
          helm push "/tmp/charts/dispatch-${CHART_VERSION}.tgz" oci://ghcr.io/misospace/charts