release.yml

name: RELEASE — Publish (preview + production)

on:
  workflow_dispatch:
    inputs:
      checks_profile:
        description: "Checks — Profile (full=all standard checks, fast=skip slow builds/smoke, none=skip all checks)"
        required: true
        type: choice
        default: full
        options:
          - full
          - fast
          - none
      dry_run:
        description: "Safety — Run checks and show plan, but do not push/deploy"
        required: true
        default: false
        type: boolean
      environment:
        description: "Deploy — Target environment (deploy/<env>/*)"
        required: true
        type: choice
        default: preview
        options:
          - preview
          - production
      deploy_targets:
        description: "Deploy — Comma-separated targets: ui,server,website,docs,cli,stack,server_runner"
        required: true
        default: ui,server,website,docs
        type: string
      force_deploy:
        description: "Deploy — Force promote + deploy for enabled targets even if no relevant changes are detected (useful after infra failures)"
        required: true
        default: false
        type: boolean
      ui_expo_action:
        description: "Deploy — UI Expo action (none|ota|native|native_submit) for the selected environment"
        required: true
        default: none
        type: choice
        options:
          - none
          - ota
          - native
          - native_submit
      desktop_mode:
        description: "Deploy — Desktop artifacts mode"
        required: true
        type: choice
        default: none
        options:
          - none
          - build_only
          - build_and_publish
      bump:
        description: "Version bump (Preset) — Default bump for changed components. Preview releases bump/commit to dev then promote dev→preview. Production releases typically promote preview→main (dev→main is supported for urgencies)."
        required: true
        type: choice
        default: none
        options:
          - none
          - patch
          - minor
          - major
      confirm:
        description: "Confirm — Choose the exact action for this environment"
        required: true
        type: choice
        options:
          - release dev to preview
          - release preview to main
          - reset main from preview
          - release dev to main
          - reset main from dev
      release_message:
        description: "Release message — Optional note to include in Expo OTA metadata and GitHub rolling release notes"
        required: false
        default: ""
        type: string

permissions:
  contents: write
  actions: read

concurrency:
  group: release-unified
  cancel-in-progress: false

jobs:
  release_actor_guard:
    name: Release actor guard
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Authorize release actor
        uses: ./.github/actions/release-actor-guard
        with:
          team_slug: release-admins
          app_id: ${{ secrets.RELEASE_BOT_APP_ID }}
          private_key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}

  ci:
    name: CI Checks (tests.yml)
    needs: [release_actor_guard]
    if: inputs.checks_profile != 'none'
    uses: ./.github/workflows/tests.yml
    with:
      run_ui: true
      run_server: true
      run_cli: true
      run_stack: true
      run_typecheck: true
      run_cli_daemon_e2e: true
      run_e2e_core: ${{ inputs.checks_profile == 'full' }}
      run_e2e_core_slow: ${{ inputs.checks_profile == 'full' }}
      run_server_db_contract: ${{ inputs.checks_profile == 'full' }}
      run_providers: false
      providers_preset: all
      providers_tier: smoke
      run_stress: false
      run_release_contracts: true
      run_installers_smoke: false
      run_binary_smoke: false
      run_self_host_systemd: false
      run_self_host_launchd: false
      run_self_host_schtasks: false
      run_self_host_daemon: false

  plan:
    name: Release Plan (inputs + changes + bump/publish decisions)
    needs: [release_actor_guard, ci]
    if: ${{ always() && needs.release_actor_guard.result == 'success' && (needs.ci.result == 'success' || needs.ci.result == 'skipped') }}
    runs-on: ubuntu-latest
    outputs:
      changed_ui: ${{ steps.plan.outputs.changed_ui }}
      changed_cli: ${{ steps.plan.outputs.changed_cli }}
      changed_server: ${{ steps.plan.outputs.changed_server }}
      changed_website: ${{ steps.plan.outputs.changed_website }}
      changed_docs: ${{ steps.plan.outputs.changed_docs }}
      changed_shared: ${{ steps.plan.outputs.changed_shared }}
      changed_stack: ${{ steps.plan.outputs.changed_stack }}
      bump_app: ${{ steps.bump_plan.outputs.bump_app }}
      bump_cli: ${{ steps.bump_plan.outputs.bump_cli }}
      bump_stack: ${{ steps.bump_plan.outputs.bump_stack }}
      bump_server: ${{ steps.bump_plan.outputs.bump_server }}
      bump_website: ${{ steps.bump_plan.outputs.bump_website }}
      should_bump: ${{ steps.bump_plan.outputs.should_bump }}
      publish_cli: ${{ steps.bump_plan.outputs.publish_cli }}
      publish_stack: ${{ steps.bump_plan.outputs.publish_stack }}
      publish_server: ${{ steps.bump_plan.outputs.publish_server }}
    steps:
      - name: Validate inputs
        run: |
          set -euo pipefail
          confirm="${{ inputs.confirm }}"
          env_name="${{ inputs.environment }}"
          mode=""

          if [ "$env_name" = "preview" ]; then
            if [ "$confirm" != "release dev to preview" ]; then
              echo "Confirmation mismatch for preview releases." >&2
              echo "Expected: release dev to preview" >&2
              echo "Got:      $confirm" >&2
              exit 1
            fi
            mode="preview_release"
          else
            case "$confirm" in
              "release preview to main") mode="promote_main_from_preview_fast_forward" ;;
              "reset main from preview") mode="promote_main_from_preview_reset" ;;
              "release dev to main") mode="promote_main_from_dev_fast_forward" ;;
              "reset main from dev") mode="promote_main_from_dev_reset" ;;
              *)
                echo "Unknown confirmation phrase: $confirm" >&2
                exit 1
                ;;
            esac
          fi

          # Validate deploy_targets extras (cli/stack are publishable targets).
          raw_targets="${{ inputs.deploy_targets }}"
          norm="$(printf '%s' "${raw_targets}" | tr '[:upper:]' '[:lower:]' | tr -d ' \t\r\n')"
          if [ -n "${norm:-}" ]; then
            IFS=',' read -r -a parts <<< "${norm}"
            for p in "${parts[@]}"; do
              [ -z "${p:-}" ] && continue
              case "${p}" in
                ui|server|website|docs|cli|stack|server_runner) ;;
                *)
                  echo "Unknown deploy_targets entry: '${p}'. Expected: ui,server,website,docs,cli,stack,server_runner" >&2
                  exit 1
                  ;;
              esac
            done
          fi

      - name: Enforce trusted refs for manual dispatch
        run: |
          set -euo pipefail
          if [ "${GITHUB_EVENT_NAME}" != "workflow_dispatch" ]; then
            exit 0
          fi
          case "${GITHUB_REF_NAME}" in
            dev|preview|main) ;;
            *)
              echo "Refusing workflow_dispatch from untrusted ref '${GITHUB_REF_NAME}'. Use dev, preview, or main." >&2
              exit 1
              ;;
          esac

      - name: Checkout dev
        uses: actions/checkout@v4
        with:
          ref: dev
          fetch-depth: 0

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 22.x
          cache: yarn
          cache-dependency-path: yarn.lock

      - name: Enable Corepack (Yarn)
        if: ${{ inputs.checks_profile == 'full' }}
        run: |
          corepack enable
          corepack prepare yarn@1.22.22 --activate

      - name: Install dependencies
        if: ${{ inputs.checks_profile == 'full' }}
        env:
          YARN_PRODUCTION: "false"
          npm_config_production: "false"
        run: yarn install --frozen-lockfile --ignore-engines

      - name: Test + typecheck
        if: inputs.checks_profile != 'none'
        run: |
          set -euo pipefail
          echo "CI checks ran in job 'ci' (tests/typecheck/e2e/providers/stress as configured)."

      - name: Build website
        if: ${{ inputs.checks_profile == 'full' }}
        run: yarn website:build

      - name: Build docs
        if: ${{ inputs.checks_profile == 'full' }}
        run: yarn docs:build

      - name: CLI smoke test (Linux)
        if: ${{ inputs.checks_profile == 'full' }}
        run: node scripts/pipeline/run.mjs smoke-cli

      - name: Compute changed components (main..dev)
        id: plan
        run: |
          set -euo pipefail

          git fetch origin main dev --prune --tags

          dev_sha="$(git rev-parse HEAD)"
          main_sha="$(git rev-parse origin/main)"

          node scripts/pipeline/run.mjs release-compute-changed-components \
            --base "$main_sha" \
            --head "$dev_sha" \
            --out "$GITHUB_OUTPUT"

      - name: Compute versioned component changes (latest release tags..release head)
        id: versioned_plan
        env:
          ENVIRONMENT: ${{ inputs.environment }}
          CONFIRM: ${{ inputs.confirm }}
        run: |
          set -euo pipefail

          git fetch origin main dev preview --prune --tags

          dev_sha="$(git rev-parse HEAD)"
          preview_sha="$(git rev-parse origin/preview)"
          plan_head_sha="$dev_sha"

          if [ "$ENVIRONMENT" = "production" ] && { [ "$CONFIRM" = "release preview to main" ] || [ "$CONFIRM" = "reset main from preview" ]; }; then
            plan_head_sha="$preview_sha"
          fi

          node scripts/pipeline/run.mjs release-compute-versioned-component-changes \
            --environment "$ENVIRONMENT" \
            --head "$plan_head_sha" \
            --out "$GITHUB_OUTPUT"

      - name: Release plan summary
        run: |
          set -euo pipefail

          {
            echo "## Release plan (dev → main)"
            echo ""
            echo "- checks_profile: \`${{ inputs.checks_profile }}\`"
            echo "- environment: \`${{ inputs.environment }}\`"
            echo "- confirm: \`${{ inputs.confirm }}\`"
            echo "- dry_run: \`${{ inputs.dry_run }}\`"
            echo "- deploy_targets: \`${{ inputs.deploy_targets }}\`"
            echo "- force_deploy: \`${{ inputs.force_deploy }}\`"
            echo "- bump: \`${{ inputs.bump }}\`"
            echo "- ui_expo_action: \`${{ inputs.ui_expo_action }}\` (builder=\`eas_cloud\`, platform=\`all\`, profile=\`auto\`)"
            echo "- desktop_mode: \`${{ inputs.desktop_mode }}\`"
            echo ""
            echo "- commits to release (main..dev): \`${{ steps.plan.outputs.commit_count }}\`"
            echo ""
            echo "### Changed components (main..dev)"
            echo "- ui: \`${{ steps.plan.outputs.changed_ui }}\`"
            echo "- cli: \`${{ steps.plan.outputs.changed_cli }}\`"
            echo "- server: \`${{ steps.plan.outputs.changed_server }}\`"
            echo "- stack: \`${{ steps.plan.outputs.changed_stack }}\`"
            echo "- website: \`${{ steps.plan.outputs.changed_website }}\`"
            echo "- docs: \`${{ steps.plan.outputs.changed_docs }}\`"
            echo "- shared (agents/protocol): \`${{ steps.plan.outputs.changed_shared }}\`"
            echo ""
            echo "### Versioned components since latest release tags"
            echo "- app: \`${{ steps.versioned_plan.outputs.changed_app }}\` (baseline=\`${{ steps.versioned_plan.outputs.app_baseline_tag || 'none' }}\`)"
            echo "- cli: \`${{ steps.versioned_plan.outputs.changed_cli }}\` (baseline=\`${{ steps.versioned_plan.outputs.cli_baseline_tag || 'none' }}\`)"
            echo "- stack: \`${{ steps.versioned_plan.outputs.changed_stack }}\` (baseline=\`${{ steps.versioned_plan.outputs.stack_baseline_tag || 'none' }}\`)"
            echo "- server: \`${{ steps.versioned_plan.outputs.changed_server }}\` (baseline=\`${{ steps.versioned_plan.outputs.server_baseline_tag || 'none' }}\`)"
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Resolve publish + bump plan
        id: bump_plan
        env:
          ENVIRONMENT: ${{ inputs.environment }}
          BUMP_PRESET: ${{ inputs.bump }}
          BUMP_APP_OVERRIDE: preset
          BUMP_CLI_OVERRIDE: preset
          BUMP_STACK_OVERRIDE: preset
          DEPLOY_TARGETS: ${{ inputs.deploy_targets }}
          CHANGED_UI: ${{ steps.plan.outputs.changed_ui }}
          CHANGED_CLI: ${{ steps.plan.outputs.changed_cli }}
          CHANGED_SERVER: ${{ steps.plan.outputs.changed_server }}
          CHANGED_WEBSITE: ${{ steps.plan.outputs.changed_website }}
          CHANGED_STACK: ${{ steps.plan.outputs.changed_stack }}
          CHANGED_SHARED: ${{ steps.plan.outputs.changed_shared }}
          VERSIONED_APP_CHANGED: ${{ steps.versioned_plan.outputs.changed_app }}
          VERSIONED_CLI_CHANGED: ${{ steps.versioned_plan.outputs.changed_cli }}
          VERSIONED_STACK_CHANGED: ${{ steps.versioned_plan.outputs.changed_stack }}
          VERSIONED_SERVER_CHANGED: ${{ steps.versioned_plan.outputs.changed_server }}
        run: |
          set -euo pipefail
          node scripts/pipeline/run.mjs release-resolve-bump-plan \
            --environment "${ENVIRONMENT}" \
            --bump-preset "${BUMP_PRESET}" \
            --bump-app-override "${BUMP_APP_OVERRIDE}" \
            --bump-cli-override "${BUMP_CLI_OVERRIDE}" \
            --bump-stack-override "${BUMP_STACK_OVERRIDE}" \
            --deploy-targets "${DEPLOY_TARGETS}" \
            --changed-ui "${CHANGED_UI}" \
            --changed-cli "${CHANGED_CLI}" \
            --changed-stack "${CHANGED_STACK}" \
            --changed-server "${CHANGED_SERVER}" \
            --changed-website "${CHANGED_WEBSITE}" \
            --changed-shared "${CHANGED_SHARED}" \
            --versioned-app-changed "${VERSIONED_APP_CHANGED}" \
            --versioned-cli-changed "${VERSIONED_CLI_CHANGED}" \
            --versioned-stack-changed "${VERSIONED_STACK_CHANGED}" \
            --versioned-server-changed "${VERSIONED_SERVER_CHANGED}" \
            --github-output "$GITHUB_OUTPUT"

  deploy_plan:
    name: deploy_plan (source → deploy branches)
    runs-on: ubuntu-latest
    environment: release-shared
    if: >-
      always() && needs.plan.result == 'success' && (
        contains(format(',{0},', inputs.deploy_targets), ',server,') ||
        contains(format(',{0},', inputs.deploy_targets), ',website,') ||
        contains(format(',{0},', inputs.deploy_targets), ',docs,') ||
        (inputs.environment == 'production' && contains(format(',{0},', inputs.deploy_targets), ',ui,'))
      )
    needs: [plan, bump_versions_dev, promote_preview, promote_main]
    outputs:
      deploy_ui_needed: ${{ steps.plan.outputs.deploy_ui_needed }}
      deploy_server_needed: ${{ steps.plan.outputs.deploy_server_needed }}
      deploy_website_needed: ${{ steps.plan.outputs.deploy_website_needed }}
      deploy_docs_needed: ${{ steps.plan.outputs.deploy_docs_needed }}
    steps:
      - name: Create GitHub App token
        id: app_token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.RELEASE_BOT_APP_ID }}
          private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}

      - name: Checkout release source
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.environment == 'production' && 'main' || 'preview' }}
          fetch-depth: 0
          token: ${{ steps.app_token.outputs.token }}

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 22.x

      - name: Compute deploy plan (deploy/<env>/* behind release source?)
        id: plan
        env:
          ENVIRONMENT: ${{ inputs.environment }}
          SOURCE_REF: ${{ inputs.environment == 'production' && 'main' || 'preview' }}
          FORCE_DEPLOY: ${{ inputs.force_deploy }}
          DEPLOY_UI: ${{ contains(format(',{0},', inputs.deploy_targets), ',ui,') }}
          DEPLOY_SERVER: ${{ contains(format(',{0},', inputs.deploy_targets), ',server,') }}
          DEPLOY_WEBSITE: ${{ contains(format(',{0},', inputs.deploy_targets), ',website,') }}
          DEPLOY_DOCS: ${{ contains(format(',{0},', inputs.deploy_targets), ',docs,') }}
        run: |
          set -euo pipefail
          node scripts/pipeline/run.mjs release-compute-deploy-plan \
            --deploy-environment "${ENVIRONMENT}" \
            --source-ref "${SOURCE_REF}" \
            --force-deploy "${FORCE_DEPLOY}" \
            --deploy-ui "${DEPLOY_UI}" \
            --deploy-server "${DEPLOY_SERVER}" \
            --deploy-website "${DEPLOY_WEBSITE}" \
            --deploy-docs "${DEPLOY_DOCS}" \
            --github-output "$GITHUB_OUTPUT"

  promote_main:
    # GitHub skips dependent jobs when a needed job is skipped unless we use always().
    # In production, bump_versions_dev is frequently skipped (bump=none), but we still
    # must promote preview -> main (or dev -> main) so downstream deploy/publish jobs can run.
    if: always() && needs.plan.result == 'success' && (needs.bump_versions_dev.result == 'success' || needs.bump_versions_dev.result == 'skipped') && inputs.dry_run != true && inputs.environment == 'production'
    needs: [plan, bump_versions_dev]
    uses: ./.github/workflows/promote-branch.yml
    secrets: inherit
    with:
      source: ${{ (inputs.confirm == 'release preview to main' || inputs.confirm == 'reset main from preview') && 'preview' || 'dev' }}
      target: main
      mode: ${{ (inputs.confirm == 'reset main from preview' || inputs.confirm == 'reset main from dev') && 'reset' || 'fast_forward' }}
      dry_run: ${{ inputs.dry_run }}
      allow_reset: ${{ inputs.confirm == 'reset main from preview' || inputs.confirm == 'reset main from dev' }}
      confirm: >-
        ${{
          (inputs.confirm == 'reset main from preview' || inputs.confirm == 'reset main from dev')
            && format('reset main from {0}', ((inputs.confirm == 'reset main from preview') && 'preview' || 'dev'))
            || format('promote main from {0}', ((inputs.confirm == 'release preview to main') && 'preview' || 'dev'))
        }}

  promote_preview:
    if: always() && needs.plan.result == 'success' && (needs.bump_versions_dev.result == 'success' || needs.bump_versions_dev.result == 'skipped') && inputs.dry_run != true && inputs.environment == 'preview'
    needs: [plan, bump_versions_dev]
    uses: ./.github/workflows/promote-branch.yml
    secrets: inherit
    with:
      source: dev
      target: preview
      mode: fast_forward
      dry_run: ${{ inputs.dry_run }}
      allow_reset: false
      confirm: promote preview from dev

  bump_versions_dev:
    if: inputs.dry_run != true && needs.plan.outputs.should_bump == 'true' && inputs.confirm != 'release preview to main' && inputs.confirm != 'reset main from preview'
    needs: [plan]
    runs-on: ubuntu-latest
    environment: release-shared
    steps:
      - name: Create GitHub App token
        id: app_token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.RELEASE_BOT_APP_ID }}
          private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}

      - name: Checkout dev
        uses: actions/checkout@v4
        with:
          ref: dev
          fetch-depth: 0
          token: ${{ steps.app_token.outputs.token }}

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 22.x
          cache: yarn
          cache-dependency-path: yarn.lock

      - name: Enable Corepack (Yarn)
        run: |
          corepack enable
          corepack prepare yarn@1.22.22 --activate

      - name: Install dependencies
        env:
          YARN_PRODUCTION: "false"
          npm_config_production: "false"
        run: yarn install --frozen-lockfile --ignore-engines

      - name: Apply version bumps (single commit)
        id: bumps
        run: |
          set -euo pipefail
          node scripts/pipeline/run.mjs release-bump-versions-dev \
            --bump-app "${{ needs.plan.outputs.bump_app }}" \
            --bump-server "${{ needs.plan.outputs.bump_server }}" \
            --bump-website "${{ needs.plan.outputs.bump_website }}" \
            --bump-cli "${{ needs.plan.outputs.bump_cli }}" \
            --bump-stack "${{ needs.plan.outputs.bump_stack }}" \
            --github-output "$GITHUB_OUTPUT"

  deploy_ui:
    if: always() && needs.plan.result == 'success' && inputs.dry_run != true && contains(format(',{0},', inputs.deploy_targets), ',ui,') && (needs.deploy_plan.outputs.deploy_ui_needed == 'true' || needs.plan.outputs.bump_app != 'none' || inputs.force_deploy == true || inputs.ui_expo_action != 'none') && (needs.bump_versions_dev.result == 'success' || needs.bump_versions_dev.result == 'skipped') && ((inputs.environment == 'production' && needs.promote_main.result == 'success') || (inputs.environment == 'preview' && needs.promote_preview.result == 'success'))
    needs: [plan, bump_versions_dev, promote_preview, promote_main, deploy_plan]
    permissions:
      contents: write
      actions: read
    uses: ./.github/workflows/promote-ui.yml
    secrets: inherit
    with:
      environment: ${{ inputs.environment }}
      force_deploy: ${{ inputs.force_deploy }}
      source_ref: ${{ inputs.environment == 'production' && 'main' || 'preview' }}
      allow_cross_promote: false
      bump: none
      deploy_web: ${{ inputs.environment == 'production' }}
      expo_action: ${{ inputs.ui_expo_action }}
      desktop_mode: ${{ inputs.desktop_mode }}
      run_tests: false
      expo_update_message: ${{ inputs.release_message }}

  deploy_server:
    if: always() && needs.plan.result == 'success' && inputs.dry_run != true && contains(format(',{0},', inputs.deploy_targets), ',server,') && (needs.deploy_plan.outputs.deploy_server_needed == 'true' || needs.plan.outputs.bump_server != 'none' || inputs.force_deploy == true) && (needs.bump_versions_dev.result == 'success' || needs.bump_versions_dev.result == 'skipped') && ((inputs.environment == 'production' && needs.promote_main.result == 'success') || (inputs.environment == 'preview' && needs.promote_preview.result == 'success'))
    needs: [plan, bump_versions_dev, promote_preview, promote_main, deploy_plan]
    permissions:
      contents: write
      actions: read
    uses: ./.github/workflows/promote-server.yml
    secrets: inherit
    with:
      environment: ${{ inputs.environment }}
      force_deploy: ${{ inputs.force_deploy }}
      source_ref: ${{ inputs.environment == 'production' && 'main' || 'preview' }}
      allow_cross_promote: false
      bump: none
      publish_runtime_release: false
      run_tests: false

  publish_server_runtime:
    if: always() && needs.plan.result == 'success' && inputs.dry_run != true && needs.plan.outputs.publish_server == 'true' && (needs.bump_versions_dev.result == 'success' || needs.bump_versions_dev.result == 'skipped') && ((inputs.environment == 'production' && needs.promote_main.result == 'success') || (inputs.environment == 'preview' && needs.promote_preview.result == 'success'))
    needs: [plan, bump_versions_dev, promote_preview, promote_main]
    permissions:
      contents: write
    uses: ./.github/workflows/publish-server-runtime.yml
    secrets: inherit
    with:
      channel: ${{ inputs.environment == 'production' && 'stable' || 'preview' }}
      source_ref: ${{ inputs.environment == 'production' && 'main' || 'preview' }}
      allow_stable: ${{ inputs.environment == 'production' }}
      release_message: ${{ inputs.release_message }}

  publish_ui_web:
    if: always() && needs.plan.result == 'success' && inputs.dry_run != true && contains(format(',{0},', inputs.deploy_targets), ',ui,') && (needs.bump_versions_dev.result == 'success' || needs.bump_versions_dev.result == 'skipped') && ((inputs.environment == 'production' && needs.promote_main.result == 'success') || (inputs.environment == 'preview' && needs.promote_preview.result == 'success'))
    needs: [plan, bump_versions_dev, promote_preview, promote_main]
    permissions:
      contents: write
    uses: ./.github/workflows/publish-ui-web.yml
    secrets: inherit
    with:
      channel: ${{ inputs.environment == 'production' && 'stable' || 'preview' }}
      source_ref: ${{ inputs.environment == 'production' && 'main' || 'preview' }}
      allow_stable: ${{ inputs.environment == 'production' }}
      release_message: ${{ inputs.release_message }}

  publish_docker:
    if: always() && needs.plan.result == 'success' && inputs.dry_run != true && (inputs.force_deploy == true || needs.plan.outputs.changed_ui == 'true' || needs.plan.outputs.changed_server == 'true' || needs.plan.outputs.changed_cli == 'true' || needs.plan.outputs.changed_stack == 'true' || needs.plan.outputs.changed_shared == 'true') && (needs.bump_versions_dev.result == 'success' || needs.bump_versions_dev.result == 'skipped') && ((inputs.environment == 'production' && needs.promote_main.result == 'success') || (inputs.environment == 'preview' && needs.promote_preview.result == 'success'))
    needs: [plan, bump_versions_dev, promote_preview, promote_main]
    permissions:
      contents: read
    uses: ./.github/workflows/publish-docker.yml
    secrets: inherit
    with:
      channel: ${{ inputs.environment == 'production' && 'stable' || 'preview' }}
      source_ref: ${{ inputs.environment == 'production' && 'main' || 'preview' }}
      push_latest: true
      build_relay: ${{ inputs.force_deploy == true || needs.plan.outputs.changed_ui == 'true' || needs.plan.outputs.changed_server == 'true' || needs.plan.outputs.changed_shared == 'true' }}
      build_dev_box: ${{ inputs.force_deploy == true || needs.plan.outputs.changed_cli == 'true' || needs.plan.outputs.changed_stack == 'true' || needs.plan.outputs.changed_shared == 'true' }}

  deploy_website:
    if: always() && needs.plan.result == 'success' && inputs.dry_run != true && contains(format(',{0},', inputs.deploy_targets), ',website,') && (needs.deploy_plan.outputs.deploy_website_needed == 'true' || needs.plan.outputs.bump_website != 'none' || inputs.force_deploy == true) && (needs.bump_versions_dev.result == 'success' || needs.bump_versions_dev.result == 'skipped') && ((inputs.environment == 'production' && needs.promote_main.result == 'success') || (inputs.environment == 'preview' && needs.promote_preview.result == 'success'))
    needs: [plan, bump_versions_dev, promote_preview, promote_main, deploy_plan]
    permissions:
      contents: read
      actions: read
    uses: ./.github/workflows/promote-website.yml
    secrets: inherit
    with:
      environment: ${{ inputs.environment }}
      force_deploy: ${{ inputs.force_deploy }}
      source_ref: ${{ inputs.environment == 'production' && 'main' || 'preview' }}
      allow_cross_promote: false
      bump: none
      run_build: true

  deploy_docs:
    if: always() && needs.plan.result == 'success' && inputs.dry_run != true && contains(format(',{0},', inputs.deploy_targets), ',docs,') && (needs.deploy_plan.outputs.deploy_docs_needed == 'true' || inputs.force_deploy == true) && (needs.bump_versions_dev.result == 'success' || needs.bump_versions_dev.result == 'skipped') && ((inputs.environment == 'production' && needs.promote_main.result == 'success') || (inputs.environment == 'preview' && needs.promote_preview.result == 'success'))
    needs: [plan, bump_versions_dev, promote_preview, promote_main, deploy_plan]
    permissions:
      contents: read
      actions: read
    uses: ./.github/workflows/promote-docs.yml
    secrets: inherit
    with:
      environment: ${{ inputs.environment }}
      force_deploy: ${{ inputs.force_deploy }}
      source_ref: ${{ inputs.environment == 'production' && 'main' || 'preview' }}
      allow_cross_promote: false
      run_build: true

  publish_npm:
    if: always() && needs.plan.result == 'success' && inputs.dry_run != true && (needs.plan.outputs.publish_cli == 'true' || needs.plan.outputs.publish_stack == 'true' || needs.plan.outputs.publish_server == 'true') && (needs.bump_versions_dev.result == 'success' || needs.bump_versions_dev.result == 'skipped') && ((inputs.environment == 'production' && needs.promote_main.result == 'success') || (inputs.environment == 'preview' && needs.promote_preview.result == 'success'))
    needs: [plan, bump_versions_dev, promote_preview, promote_main]
    permissions:
      contents: write
      id-token: write
    uses: ./.github/workflows/release-npm.yml
    secrets: inherit
    with:
      publish_cli: ${{ needs.plan.outputs.publish_cli == 'true' }}
      publish_stack: ${{ needs.plan.outputs.publish_stack == 'true' }}
      publish_server: ${{ needs.plan.outputs.publish_server == 'true' }}
      channel: ${{ inputs.environment }}
      source_ref: ${{ inputs.environment == 'production' && 'main' || 'preview' }}
      npm_tag: ${{ inputs.environment == 'production' && 'latest' || 'next' }}
      run_tests: false
      release_message: ${{ inputs.release_message }}

  sync_dev:
    if: inputs.dry_run != true && inputs.environment == 'production' && (vars.RELEASE_SYNC_DEV_FROM_MAIN == '' || vars.RELEASE_SYNC_DEV_FROM_MAIN == 'true')
    needs: [plan, bump_versions_dev, promote_main]
    uses: ./.github/workflows/promote-branch.yml
    secrets: inherit
    with:
      source: main
      target: dev
      mode: fast_forward
      dry_run: false
      allow_reset: false
      confirm: promote dev from main