release.yml

name: Release Build - Codeoid

on:
  release:
    types:
      - published

env:
  REGEX_PATTERN: "^v[0-9]+\\.[0-9]+\\.[0-9]+$"

jobs:
  highflame-validate:
    permissions:
      contents: 'read'
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          persist-credentials: true

      - name: Validate Release Tag
        id: validate_tag
        shell: bash
        run: |-
          if [[ "${GITHUB_REF_NAME}" =~ ${{ env.REGEX_PATTERN }} ]] ; then
            echo "Valid version format: ${GITHUB_REF_NAME}"
          else
            echo "Invalid version format: ${GITHUB_REF_NAME}"
            exit 1
          fi

  highflame-release:
    needs:
      - highflame-validate
    permissions:
      contents: write
      id-token: write
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Extract version from release
        id: version
        env:
          RELEASE_NAME: ${{ github.event.release.name }}
        shell: bash
        run: |-
          VERSION=$(echo "$RELEASE_NAME" | sed 's|^v||g')
          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
          echo "Releasing version: $VERSION"

      - name: Update root package.json
        env:
          VERSION: ${{ steps.version.outputs.VERSION }}
        shell: bash
        run: |-
          jq ".version = \"${VERSION}\"" package.json > package.json.tmp
          mv package.json.tmp package.json
          echo "Updated root package.json:"
          grep '"version"' package.json

      - name: Update protocol package.json
        env:
          VERSION: ${{ steps.version.outputs.VERSION }}
        shell: bash
        run: |-
          cd packages/protocol
          jq ".version = \"${VERSION}\"" package.json > package.json.tmp
          mv package.json.tmp package.json
          echo "Updated protocol package.json:"
          grep '"version"' package.json

      - name: Update core package.json
        env:
          VERSION: ${{ steps.version.outputs.VERSION }}
        shell: bash
        run: |-
          cd packages/core
          jq ".version = \"${VERSION}\"" package.json > package.json.tmp
          mv package.json.tmp package.json
          echo "Updated core package.json:"
          grep '"version"' package.json

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Setup Node (npm publish + provenance)
        uses: actions/setup-node@v4
        with:
          node-version: 22
          registry-url: "https://registry.npmjs.org"

      # OIDC Trusted Publishing requires the npm CLI >= 11.5.1; node 22 ships
      # an older 10.x. No token after this — auth is the GitHub OIDC id-token.
      - name: Upgrade npm for Trusted Publishing
        shell: bash
        run: npm install -g npm@latest

      - name: Install dependencies
        shell: bash
        run: bun install --frozen-lockfile

      - name: Update the dependencies version
        shell: bash
        run: |-
          VERSION="${GITHUB_REF_NAME#v}"

          jq --arg version "^${VERSION}" '
            .dependencies["@highflame/codeoid-core"] = $version |
            .dependencies["@highflame/codeoid-protocol"] = $version' \
            package.json > package.json.tmp && mv package.json.tmp package.json

          cd packages/core
          jq --arg version "^${VERSION}" \
            '.peerDependencies["@highflame/codeoid-protocol"] = $version' \
            package.json > package.json.tmp && mv package.json.tmp package.json

      # Every publishable package ships at the SAME version, and the tag is that
      # version. One gate replaces per-package version bookkeeping: if this
      # passes, all three publishes below are known-correct and known-new.
      - name: Verify workspace versions are in lockstep with the tag
        shell: bash
        run: bun run check:versions "${{ env.GITHUB_REF_NAME }}"

      - name: Build web UI
        shell: bash
        run: |-
          cd web
          bun install --frozen-lockfile
          bun run build

      - name: Test
        shell: bash
        run: bun run test

      - name: Verify package version matches the tag
        shell: bash
        run: |-
          PKG="$(node -p "require('./package.json').version")"
          TAG="${GITHUB_REF_NAME#v}"
          if [ "$PKG" != "$TAG" ]; then
            echo "::error::package.json version ($PKG) does not match tag ($TAG)"
            exit 1
          fi

      # @highflame/codeoid-protocol is a workspace dependency of codeoid; publish it FIRST
      # (only when its version is new) so codeoid's published dep resolves.
      # NOTE: requires a separate npm Trusted Publisher configured for
      # @highflame/codeoid-protocol at npmjs.com (same OIDC setup as codeoid) before the
      # first release that introduces a new protocol version.
      - name: Publish @highflame/codeoid-protocol (OIDC) — only if version is new
        shell: bash
        run: |-
          cd packages/protocol
          VER="$(node -p "require('./package.json').version")"
          if npm view "@highflame/codeoid-protocol@$VER" version >/dev/null 2>&1; then
            echo "@highflame/codeoid-protocol@$VER already published — skipping"
          else
            npm publish
          fi

      # @highflame/codeoid-core (client transport + store semantics — consumed by the
      # mobile app from the registry; web uses the in-repo copy). Publishes
      # after protocol (its peer dep) and needs its own Trusted Publisher +
      # one-time manual bootstrap publish, same as protocol.
      - name: Publish @highflame/codeoid-core (OIDC) — only if version is new
        shell: bash
        run: |-
          cd packages/core
          VER="$(node -p "require('./package.json').version")"
          if npm view "@highflame/codeoid-core@$VER" version >/dev/null 2>&1; then
            echo "@highflame/codeoid-core@$VER already published — skipping"
          else
            npm publish
          fi

      # No NODE_AUTH_TOKEN: auth comes from the GitHub OIDC id-token via npm's
      # Trusted Publisher (configured on the package at npmjs.com). Provenance
      # is generated automatically from the same OIDC identity.
      - name: Publish codeoid to npm (OIDC Trusted Publishing)
        shell: bash
        run: npm publish