shared-package-release.yml

name: Shared Package Release Handler

on:
  repository_dispatch:
    types: [shared-package-release]

permissions:
  contents: write
  issues: write

concurrency:
  group: 'shared-package-release-${{ github.event.client_payload.release_tag }}'
  cancel-in-progress: false

env:
  NODE_VERSION: 24.17.0
  # Match the Python version documented in requirements.in so the regenerated
  # lockfile stays valid across the supported Python range.
  PYTHON_VERSION: '3.10'

jobs:
  update-shared-packages:
    name: Update shared packages
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Install Node
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Install Python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Validate dispatch payload
        env:
          RELEASE_TAG: ${{ github.event.client_payload.release_tag }}
        run: |
          set -euo pipefail
          if [ -z "${RELEASE_TAG}" ]; then
            echo 'release_tag is missing from the dispatch payload.' >&2
            exit 1
          fi
          if ! printf '%s' "${RELEASE_TAG}" | grep -Eq '^v?[0-9A-Za-z][0-9A-Za-z.+-]*$'; then
            echo "release_tag '${RELEASE_TAG}' is not a valid version/ref." >&2
            exit 1
          fi

      - name: Normalize release tag
        id: release_version
        env:
          RELEASE_TAG: ${{ github.event.client_payload.release_tag }}
        run: |
          set -euo pipefail
          VERSION="${RELEASE_TAG#v}"
          echo "value=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Create branch for this release
        env:
          RELEASE_TAG: ${{ github.event.client_payload.release_tag }}
        run: |
          set -euo pipefail
          BRANCH="shared-package-v${RELEASE_TAG#v}"
          git fetch origin main
          # Fetch any pre-existing remote branch so --force-with-lease has a ref.
          git fetch origin "+refs/heads/${BRANCH}:refs/remotes/origin/${BRANCH}" 2>/dev/null || true
          git checkout -B "$BRANCH" origin/main

      - name: Update npm dependency
        env:
          NPM_DEP: ${{ github.event.client_payload.npm_dependency }}
          RELEASE_VERSION: ${{ steps.release_version.outputs.value }}
        run: |
          set -euo pipefail
          if [ -z "${NPM_DEP}" ]; then
            echo 'No npm dependency in payload; skipping.'
            exit 0
          fi
          npm install "${NPM_DEP}@${RELEASE_VERSION}"

      - name: Update pip dependency
        env:
          PIP_DEP: ${{ github.event.client_payload.pip_dependency }}
          RELEASE_VERSION: ${{ steps.release_version.outputs.value }}
        run: |
          set -euo pipefail
          if [ -z "${PIP_DEP}" ]; then
            echo 'No pip dependency in payload; skipping.'
            exit 0
          fi
          if [ ! -f requirements.in ]; then
            echo 'No requirements.in found; skipping.'
            exit 0
          fi
          python -m pip install --upgrade uv
          # Rewrite the pin (case-insensitive) for the shared package only.
          sed -i -E "s/^${PIP_DEP}([<>=!~].*)?\$/${PIP_DEP}==${RELEASE_VERSION}/I" requirements.in
          if ! grep -iEq "^${PIP_DEP}==${RELEASE_VERSION}([[:space:];].*)?\$" requirements.in; then
            echo "Failed to pin ${PIP_DEP}==${RELEASE_VERSION} in requirements.in." >&2
            exit 1
          fi
          # Scope the re-resolve to the shared package and pin to the documented
          # Python version so unrelated deps and version markers are preserved.
          uv pip compile --generate-hashes \
            --upgrade-package "${PIP_DEP}" \
            --python-version "${PYTHON_VERSION}" \
            -o requirements.txt requirements.in

      - name: Push branch and open tracking issue if changed
        env:
          RELEASE_TAG: ${{ github.event.client_payload.release_tag }}
          RELEASE_URL: ${{ github.event.client_payload.release_url }}
          REPO: ${{ github.repository }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          git config user.name 'github-actions[bot]'
          git config user.email 'github-actions[bot]@users.noreply.github.com'
          if git diff --quiet; then
            echo 'No changes detected.'
            exit 0
          fi
          BRANCH="shared-package-v${RELEASE_TAG#v}"
          git add -A
          git commit -m "Upgrade shared package to ${RELEASE_TAG}"
          git push --force-with-lease --set-upstream origin "$BRANCH"
          COMPARE_URL="https://github.com/${REPO}/compare/main...${BRANCH}?expand=1"
          TITLE="[Shared Package] Open PR to upgrade to ${RELEASE_TAG}"
          {
            echo "### Shared package upgrade ready"
            echo ''
            echo "Branch \`${BRANCH}\` has been pushed."
            echo ''
            echo "[Open the pull request](${COMPARE_URL})"
            echo ''
            echo "Source release: ${RELEASE_URL}"
          } >> "$GITHUB_STEP_SUMMARY"
          BODY_FILE="$(mktemp)"
          cat > "$BODY_FILE" <<EOF
          Branch \`${BRANCH}\` has been pushed with the shared package upgrade to ${RELEASE_TAG}.

          Organization settings prevent this workflow from opening pull requests automatically. Please open the PR manually:

          ${COMPARE_URL}

          Source release: ${RELEASE_URL}
          EOF
          # Reuse an existing open tracking issue for this release if present.
          EXISTING="$(gh issue list --repo "$REPO" --state open --search "in:title ${TITLE}" --json number,title --jq "map(select(.title == \"${TITLE}\")) | .[0].number // empty" 2>/dev/null || true)"
          if [ -n "${EXISTING}" ]; then
            echo "Reusing existing tracking issue #${EXISTING}."
            gh issue comment "${EXISTING}" --repo "$REPO" --body-file "$BODY_FILE" \
              || echo 'Could not comment on issue; compare URL is in the job summary.'
          else
            gh issue create --repo "$REPO" --title "${TITLE}" --body-file "$BODY_FILE" \
              || echo 'Could not create issue (Issues may be disabled); compare URL is in the job summary.'
          fi