release.yml

name: Release

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      baseline_ref:
        description: "Override baseline (commit SHA or tag) for the changeset generator. Leave empty to use the latest release-* tag."
        required: false

env:
  NODE_VERSION: lts/jod

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    outputs:
      hasReleases: ${{ steps.detect.outputs.hasReleases }}
      pendingReleases: ${{ steps.detect.outputs.pendingReleases }}
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          fetch-tags: true
          token: ${{ secrets.RELEASE_PLEASE_AUTH }}

      - name: Install pnpm
        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8

      - name: Set up node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Generate changesets from conventional commits
        env:
          BASELINE_REF: ${{ inputs.baseline_ref }}
        run: node tools/scripts/commits-to-changesets.mjs

      # Runs BEFORE the changesets action so it reads main's working tree
      # (the action may switch the working dir to its PR branch).
      - name: Detect pending releases
        id: detect
        run: |
          PENDING=$(node tools/scripts/detect-pending-releases.mjs)
          echo "pendingReleases=$PENDING" >> "$GITHUB_OUTPUT"
          if [ "$PENDING" = "[]" ]; then
            echo "hasReleases=false" >> "$GITHUB_OUTPUT"
          else
            echo "hasReleases=true" >> "$GITHUB_OUTPUT"
          fi
          echo "Pending releases: $PENDING"

      # Version-only mode: opens/updates the changeset-release/main version PR
      # when .changeset/*.md files exist. No publish step — job 2 handles
      # npm publishing and GitHub releases with the right tag format.
      - name: Changesets action
        uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # v1.8.0
        with:
          version: pnpm changeset:version
          commit: "chore(main): release"
          title: "chore(main): release"
          createGithubReleases: false
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_PLEASE_AUTH }}

  publish:
    runs-on: ubuntu-latest
    needs: release
    if: needs.release.outputs.hasReleases == 'true'
    permissions:
      contents: write
      id-token: write
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          fetch-tags: true
          token: ${{ secrets.RELEASE_PLEASE_AUTH }}

      - name: Install pnpm
        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8

      - name: Set up node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          registry-url: "https://registry.npmjs.org"
          cache: pnpm

      # Trusted publishing requires npm >= 11.5.1
      - run: npm install -g npm@~11.10.0

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Get publishable libs
        id: get-libs
        run: |
          LIBS_CSV=$(node -e "const nx = require('./nx.json'); console.log(nx.release.projects.map(p => p.replace('libs/', '')).join(','))")
          LIBS_SPACE=$(node -e "const nx = require('./nx.json'); console.log(nx.release.projects.map(p => p.replace('libs/', '')).join(' '))")
          echo "libs_csv=$LIBS_CSV" >> $GITHUB_OUTPUT
          echo "libs_space=$LIBS_SPACE" >> $GITHUB_OUTPUT

      - name: Build publishable libs
        run: pnpm exec nx run-many --target=build --projects=${{ steps.get-libs.outputs.libs_csv }} --parallel

      - name: Prepare packages for publishing
        run: |
          for lib in ${{ steps.get-libs.outputs.libs_space }}; do
            if [ -d "dist/libs/$lib" ]; then
              echo "Preparing $lib for publishing..."
              cp "libs/$lib/README.md" "dist/libs/$lib/" 2>/dev/null || true
              node tools/scripts/prepare-publish.mjs "dist/libs/$lib/package.json"
            fi
          done

      # nx release publish is idempotent — it skips packages already on npm.
      - name: Publish released packages
        run: pnpm exec nx release publish --tag latest --access public --provenance

      # Per-package `<short>-v<version>` tag + GitHub release for every pending
      # entry — apps included. Runs AFTER npm publish so a failed publish
      # doesn't leave orphan tags. The `cowswap-v*` and `explorer-v*` tags
      # this pushes are what triggers deployment.yml.
      - name: Create tags and GitHub releases
        env:
          GH_TOKEN: ${{ secrets.RELEASE_PLEASE_AUTH }}
          PENDING_RELEASES: ${{ needs.release.outputs.pendingReleases }}
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

          node -e '
            const pkgs = JSON.parse(process.env.PENDING_RELEASES || "[]");
            for (const p of pkgs) {
              process.stdout.write(`${p.tag}\t${p.path}\n`);
            }
          ' > /tmp/pending.tsv

          while IFS=$'\t' read -r tag path; do
            [ -z "$tag" ] && continue
            echo "Creating tag and release for ${tag}"

            if [ -f "${path}/CHANGELOG.md" ]; then
              NOTES=$(awk '/^## /{p++; if(p==2)exit; if(p==1)next} p==1' "${path}/CHANGELOG.md")
            else
              NOTES=""
            fi
            [ -z "$NOTES" ] && NOTES="Release ${tag}"

            git tag -a "${tag}" -m "Release ${tag}"
            git push origin "${tag}"

            printf '%s\n' "$NOTES" > /tmp/notes.md
            gh release create "${tag}" \
              --title "${tag}" \
              --notes-file /tmp/notes.md
          done < /tmp/pending.tsv

      # Converter baseline tag. The converter's `git describe --match release-*`
      # depends on this to know where to start scanning commits next run.
      - name: Tag release baseline
        run: |
          TAG="release-$(date -u +%Y%m%dT%H%M%SZ)"
          git tag -a "$TAG" -m "Release published at $TAG"
          git push origin "$TAG"