version-release.yml

name: Version Release

on:
  push:
    branches:
      - main
    paths:
      - 'VERSION'
  workflow_dispatch:

concurrency:
  group: version-release
  cancel-in-progress: false

permissions:
  contents: write

jobs:
  release:
    if: ${{ github.repository_owner == 'AOSSIE-Org' }}
    runs-on: ubuntu-latest
    permissions:
      contents: write

    outputs:
      version: ${{ steps.get_version.outputs.version }}
      released: ${{ steps.publish_release.outputs.released }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          persist-credentials: true

      - name: Verify actor is a maintainer
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const { data: permission } = await github.rest.repos.getCollaboratorPermissionLevel({
              owner: context.repo.owner,
              repo: context.repo.repo,
              username: context.actor,
            }).catch(() => ({ data: { permission: 'none' } }));
            
            if (permission.permission !== 'admin' && permission.permission !== 'write') {
              core.setFailed(`Actor '${context.actor}' does not have write access to this repository. Aborting release.`);
            } else {
              console.log(`✓ Actor '${context.actor}' is a verified repository maintainer.`);
            }

      - name: Read VERSION file
        id: get_version
        run: |
          VERSION=$(cat VERSION | tr -d '[:space:]')
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "Version detected: $VERSION"

      - name: Validate VERSION format
        run: |
          VERSION="${{ steps.get_version.outputs.version }}"
          if ! [[ $VERSION =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Error: VERSION must follow semantic versioning (e.g., 1.0.0)"
            exit 1
          fi
          echo "✓ Version format is valid: $VERSION"

      - name: Check if tag already exists
        run: |
          VERSION="${{ steps.get_version.outputs.version }}"
          if git show-ref --tags --verify --quiet "refs/tags/v$VERSION"; then
            echo "Error: Tag v$VERSION already exists"
            exit 1
          fi
          echo "✓ Tag v$VERSION does not exist yet"

      - name: Create and push tag
        run: |
          VERSION="${{ steps.get_version.outputs.version }}"
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git tag -a "v$VERSION" -m "Release version $VERSION"
          git push origin "v$VERSION"
          echo "✓ Created and pushed tag v$VERSION"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Find and Publish Draft Release
        id: publish_release
        uses: actions/github-script@v7
        env:
          VERSION: v${{ steps.get_version.outputs.version }}
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const version = process.env.VERSION;

            // Get all releases
            const { data: releases } = await github.rest.repos.listReleases({
              owner: context.repo.owner,
              repo: context.repo.repo,
            });

            // Find the draft release
            const draftRelease = releases.find(release => release.draft === true);

            if (draftRelease) {
              console.log(`Found draft release: ${draftRelease.name}`);

              // Update and publish the draft release
              await github.rest.repos.updateRelease({
                owner: context.repo.owner,
                repo: context.repo.repo,
                release_id: draftRelease.id,
                tag_name: version,
                name: version,
                draft: false,
              });

              console.log(`✓ Published draft release as ${version}`);
              core.setOutput('released', 'true');
            } else {
              console.log('⚠️ No draft release found. Creating release automatically.');

              await github.rest.repos.createRelease({
                owner: context.repo.owner,
                repo: context.repo.repo,
                tag_name: version,
                name: version,
                body: `## Release ${version}\n\nThis release was automatically created when the VERSION file was updated.`,
                draft: false,
                prerelease: false,
              });

              console.log(`✓ Created and published release ${version}`);
              core.setOutput('released', 'true');
            }

      - name: Release Summary
        run: |
          echo "### Release Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "- **Version:** v${{ steps.get_version.outputs.version }}" >> $GITHUB_STEP_SUMMARY
          echo "- **Tag Created:** ✓" >> $GITHUB_STEP_SUMMARY
          if [ "${{ steps.publish_release.outputs.released }}" = "true" ]; then
            echo "- **GitHub Release:** ✓" >> $GITHUB_STEP_SUMMARY
          else
            echo "- **GitHub Release:** ✗ (no draft found)" >> $GITHUB_STEP_SUMMARY
          fi

  build:
    needs: release
    if: ${{ github.repository_owner == 'AOSSIE-Org' && needs.release.outputs.released == 'true' }}
    runs-on: ubuntu-latest

    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'

      - name: Install dependencies
        run: npm ci

      - name: Sync version from VERSION file
        env:
          VERSION: ${{ needs.release.outputs.version }}
        run: |
          echo "Syncing package.json version to $VERSION"
          npm version "$VERSION" --no-git-tag-version --allow-same-version
          echo "✓ package.json version set to $VERSION"

      - name: Build
        run: npm run build

      - name: Run tests
        run: npm test

      - name: Pack package
        run: npm pack --pack-destination /tmp/pack

      - name: Upload package tarball
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: npm-package
          path: /tmp/pack/*.tgz
          retention-days: 1

  publish:
    needs: [release, build]
    if: ${{ github.repository_owner == 'AOSSIE-Org' && needs.release.outputs.released == 'true' }}
    runs-on: ubuntu-latest

    permissions:
      contents: read
      id-token: write

    steps:
      - name: Download package tarball
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: npm-package
          path: /tmp/pack

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '22'
          registry-url: 'https://registry.npmjs.org'

      - name: Update npm for Trusted Publishing
        run: npm install -g npm@11.5.1

      - name: Publish to npm
        run: npm publish /tmp/pack/*.tgz --provenance --access public

      - name: Publish Summary
        run: |
          echo "### npm Publish Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "- **Package:** @aossie-org/thrubox-client" >> $GITHUB_STEP_SUMMARY
          echo "- **Version:** ${{ needs.release.outputs.version }}" >> $GITHUB_STEP_SUMMARY
          echo "- **Registry:** https://www.npmjs.com/package/@aossie-org/thrubox-client" >> $GITHUB_STEP_SUMMARY
          echo "- **Provenance:** ✓ (supply-chain attestation enabled)" >> $GITHUB_STEP_SUMMARY