publish.yml

name: Publish releases
# Consolidates canary and stable releases into single workflow
# Trusted workflow for publishing to npm

on:
  push:
    branches: [master]
    paths-ignore:
      - '*.md'
      - 'docs/**'
      - '**/CHANGELOG.md'
  workflow_dispatch:
    inputs:
      version_specifier:
        description: 'Stable: semver bump (patch|minor|major|pre*) or exact version (v1.2.3)'
        required: false
        type: string
      beta_version:
        description: 'Beta: explicit prerelease version (e.g. 2.101.0-beta.0). Select your feature branch above.'
        required: false
        type: string
      next_prerelease:
        description: 'Next: publish a v3 prerelease from the selected branch (must be v3).'
        required: false
        type: boolean
        default: false

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
  cancel-in-progress: ${{ github.event_name == 'push' }}

jobs:
  release-stable: # stable releases can only be manually triggered
    if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.version_specifier != '' }}
    runs-on: ubuntu-latest
    environment: npm-publish
    outputs:
      released_version: ${{ steps.extract-version.outputs.version }}
    permissions:
      contents: read
      id-token: write

    steps:
      - name: Generate token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ secrets.APP_CLIENT_ID }}
          private-key: ${{ secrets.PRIVATE_KEY }}
      - name: Check if actor is member of admin or sdk team
        id: team-check
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ steps.app-token.outputs.token }}
          script: |
            const org = 'supabase'
            const actor = process.env.GITHUB_TRIGGERING_ACTOR

            async function isTeamMember(team_slug) {
              try {
                const res = await github.rest.teams.getMembershipForUserInOrg({
                  org,
                  team_slug,
                  username: actor,
                })
                return res && res.status === 200
              } catch (_) {
                return false
              }
            }
            const isAdmin = await isTeamMember('admin')
            const isSdk = await isTeamMember('sdk')
            const isMember = isAdmin || isSdk
            core.setOutput('is_team_member', isMember ? 'true' : 'false')

      - name: Fail if not authorized
        if: ${{ steps.team-check.outputs.is_team_member != 'true' }}
        run: |
          echo "You must be a member of @supabase/admin or @supabase/sdk."
          exit 1

      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0

      - name: Configure Dependency Firewall registry
        shell: bash
        env:
          DF_FIREWALL_TOKEN: ${{ secrets.DF_FIREWALL_TOKEN }}
        run: |
          # The firewall token is withheld from fork-triggered PR runs, so only route
          # through the firewall when the token is present. Forks fall back to the
          # default public npm registry (install still uses --frozen-lockfile).
          if [ -n "$DF_FIREWALL_TOKEN" ]; then
            pnpm config set //firewall.depthfirst.com/npm/:_authToken "$DF_FIREWALL_TOKEN"
            pnpm config set registry https://firewall.depthfirst.com/npm/
          else
            echo "No DF_FIREWALL_TOKEN (likely a fork PR); using the default public npm registry."
          fi

      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'
          registry-url: 'https://registry.npmjs.org'

      - name: Setup Deno
        uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5
        with:
          deno-version: v2.8.2

      - name: Export pinned Deno path
        run: echo "DENO_BIN_PATH=$(which deno)" >> "$GITHUB_ENV"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Configure git
        run: |
          git config --global user.name "supabase-releaser[bot]"
          git config --global user.email "supabase-releaser[bot]@users.noreply.github.com"

      - name: Validate input
        env:
          VERSION_SPECIFIER: ${{ github.event.inputs.version_specifier }}
        run: |
          VS="${VERSION_SPECIFIER}"
          echo "Validating: $VS"

          if [[ "$VS" =~ ^(patch|minor|major|prepatch|preminor|premajor|prerelease)$ ]]; then
            echo "✔ bump keyword"
          elif [[ "$VS" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
            echo "✔ explicit version"
          else
            echo "❌ Invalid version_specifier: '$VS'"
            echo "   Use: patch|minor|major|pre*, or v1.2.3"
            exit 1
          fi

      - name: Release stable version
        env:
          NPM_CONFIG_PROVENANCE: true
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          VERSION_SPECIFIER: ${{ github.event.inputs.version_specifier }}
        shell: bash
        run: pnpm run release-stable -- --versionSpecifier "$VERSION_SPECIFIER"

      - name: Extract released version
        id: extract-version
        shell: bash
        run: |
          set -euo pipefail
          VERSION=$(cat .release-version)
          if [[ -z "$VERSION" ]]; then
            exit 1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Summary
        if: ${{ success() }}
        env:
          VERSION_SPECIFIER: ${{ github.event.inputs.version_specifier }}
        run: |
          echo "## ✅ Stable Release" >> $GITHUB_STEP_SUMMARY
          echo "- **Version specifier:** \`${VERSION_SPECIFIER}\`" >> $GITHUB_STEP_SUMMARY
          echo "- **Source commit:** HEAD of the checked-out branch" >> $GITHUB_STEP_SUMMARY
          echo "- **Dist-tag:** \`latest\`" >> $GITHUB_STEP_SUMMARY

  docs-after-stable-release:
    name: Generate Documentation
    needs: release-stable
    if: ${{ github.event_name == 'workflow_dispatch' && needs.release-stable.result == 'success' }}
    uses: ./.github/workflows/docs.yml
    permissions:
      actions: read
      contents: write
    secrets: inherit

  trigger-dogfood:
    name: Trigger Dogfood
    needs: release-stable
    if: ${{ github.event_name == 'workflow_dispatch' && needs.release-stable.result == 'success' }}
    uses: ./.github/workflows/dogfood.yml
    secrets:
      APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }}
      PRIVATE_KEY: ${{ secrets.PRIVATE_KEY }}
      DOGFOOD_APP_CLIENT_ID: ${{ secrets.DOGFOOD_APP_CLIENT_ID }}
      DOGFOOD_APP_PRIVATE_KEY: ${{ secrets.DOGFOOD_APP_PRIVATE_KEY }}
    with:
      version: ${{ needs.release-stable.outputs.released_version }}
      source: supabase-js-stable-release

  trigger-supabase-docs-update:
    name: Trigger Supabase Docs Update
    runs-on: ubuntu-latest
    needs: [release-stable, docs-after-stable-release]
    if: ${{ github.event_name == 'workflow_dispatch' && needs.release-stable.result == 'success' && needs.docs-after-stable-release.result == 'success' }}
    steps:
      - name: Generate token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ secrets.APP_CLIENT_ID }}
          private-key: ${{ secrets.PRIVATE_KEY }}
          owner: supabase
          repositories: supabase, supabase-js

      - name: Trigger supabase/supabase docs workflow
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ steps.app-token.outputs.token }}
          script: |
            await github.rest.actions.createWorkflowDispatch({
              owner: 'supabase',
              repo: 'supabase',
              workflow_id: 'docs-js-libs-update.yml',
              ref: 'master',
              inputs: {
                version: '${{ needs.release-stable.outputs.released_version }}',
                source: 'supabase-js-stable-release'
              }
            });

  release-beta:
    if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.beta_version != '' }}
    runs-on: ubuntu-latest
    environment: npm-publish
    permissions:
      contents: read
      id-token: write

    steps:
      - name: Generate token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ secrets.APP_CLIENT_ID }}
          private-key: ${{ secrets.PRIVATE_KEY }}

      - name: Check if actor is member of admin or sdk team
        id: team-check
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ steps.app-token.outputs.token }}
          script: |
            const org = 'supabase'
            const actor = process.env.GITHUB_TRIGGERING_ACTOR

            async function isTeamMember(team_slug) {
              try {
                const res = await github.rest.teams.getMembershipForUserInOrg({
                  org,
                  team_slug,
                  username: actor,
                })
                return res && res.status === 200
              } catch (_) {
                return false
              }
            }
            const isAdmin = await isTeamMember('admin')
            const isSdk = await isTeamMember('sdk')
            const isMember = isAdmin || isSdk
            core.setOutput('is_team_member', isMember ? 'true' : 'false')

      - name: Fail if not authorized
        if: ${{ steps.team-check.outputs.is_team_member != 'true' }}
        run: |
          echo "You must be a member of @supabase/admin or @supabase/sdk."
          exit 1

      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0

      - name: Configure Dependency Firewall registry
        shell: bash
        env:
          DF_FIREWALL_TOKEN: ${{ secrets.DF_FIREWALL_TOKEN }}
        run: |
          # The firewall token is withheld from fork-triggered PR runs, so only route
          # through the firewall when the token is present. Forks fall back to the
          # default public npm registry (install still uses --frozen-lockfile).
          if [ -n "$DF_FIREWALL_TOKEN" ]; then
            pnpm config set //firewall.depthfirst.com/npm/:_authToken "$DF_FIREWALL_TOKEN"
            pnpm config set registry https://firewall.depthfirst.com/npm/
          else
            echo "No DF_FIREWALL_TOKEN (likely a fork PR); using the default public npm registry."
          fi

      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'
          registry-url: 'https://registry.npmjs.org'

      - name: Setup Deno
        uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5
        with:
          deno-version: v2.8.2

      - name: Export pinned Deno path
        run: echo "DENO_BIN_PATH=$(which deno)" >> "$GITHUB_ENV"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Configure git
        run: |
          git config --global user.name "supabase-releaser[bot]"
          git config --global user.email "supabase-releaser[bot]@users.noreply.github.com"

      - name: Release Beta version
        env:
          NPM_CONFIG_PROVENANCE: true
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          BETA_VERSION: ${{ github.event.inputs.beta_version }}
        run: pnpm run release-beta -- --version "$BETA_VERSION"

      - name: Summary
        if: ${{ success() }}
        env:
          BETA_VERSION: ${{ github.event.inputs.beta_version }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          echo "## ✅ Beta Release" >> $GITHUB_STEP_SUMMARY
          echo "- **Version:** \`${BETA_VERSION}\`" >> $GITHUB_STEP_SUMMARY
          echo "- **Branch:** \`${REF_NAME}\`" >> $GITHUB_STEP_SUMMARY
          echo "- **Dist-tag:** \`beta\`" >> $GITHUB_STEP_SUMMARY

  notify-beta-failure:
    name: Notify Slack for Beta failure
    needs: release-beta
    if: ${{ always() && github.event_name == 'workflow_dispatch' && needs.release-beta.result == 'failure' }}
    uses: ./.github/workflows/slack-notify.yml
    secrets:
      SLACK_CLIENT_LIBS_WEBHOOK: ${{ secrets.SLACK_CLIENT_LIBS_WEBHOOK }}
    with:
      title: 'Beta Release'
      status: 'failure'

  notify-beta-success:
    name: Notify Slack for Beta success
    needs: release-beta
    if: ${{ github.event_name == 'workflow_dispatch' && needs.release-beta.result == 'success' }}
    uses: ./.github/workflows/slack-notify.yml
    secrets:
      SLACK_CLIENT_LIBS_WEBHOOK: ${{ secrets.SLACK_CLIENT_LIBS_WEBHOOK }}
    with:
      title: 'Beta Release'
      status: 'success'
      version: ${{ github.event.inputs.beta_version }}

  release-next:
    # v3 next prerelease — manual dispatch only, must be run from the v3 branch.
    if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.next_prerelease == 'true' && github.ref == 'refs/heads/v3' }}
    runs-on: ubuntu-latest
    environment: npm-publish
    permissions:
      contents: read
      id-token: write

    steps:
      - name: Generate token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ secrets.APP_CLIENT_ID }}
          private-key: ${{ secrets.PRIVATE_KEY }}

      - name: Check if actor is member of admin or sdk team
        id: team-check
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ steps.app-token.outputs.token }}
          script: |
            const org = 'supabase'
            const actor = process.env.GITHUB_TRIGGERING_ACTOR

            async function isTeamMember(team_slug) {
              try {
                const res = await github.rest.teams.getMembershipForUserInOrg({
                  org,
                  team_slug,
                  username: actor,
                })
                return res && res.status === 200
              } catch (_) {
                return false
              }
            }
            const isAdmin = await isTeamMember('admin')
            const isSdk = await isTeamMember('sdk')
            const isMember = isAdmin || isSdk
            core.setOutput('is_team_member', isMember ? 'true' : 'false')

      - name: Fail if not authorized
        if: ${{ steps.team-check.outputs.is_team_member != 'true' }}
        run: |
          echo "You must be a member of @supabase/admin or @supabase/sdk."
          exit 1

      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0

      - name: Configure Dependency Firewall registry
        shell: bash
        env:
          DF_FIREWALL_TOKEN: ${{ secrets.DF_FIREWALL_TOKEN }}
        run: |
          # The firewall token is withheld from fork-triggered PR runs, so only route
          # through the firewall when the token is present. Forks fall back to the
          # default public npm registry (install still uses --frozen-lockfile).
          if [ -n "$DF_FIREWALL_TOKEN" ]; then
            pnpm config set //firewall.depthfirst.com/npm/:_authToken "$DF_FIREWALL_TOKEN"
            pnpm config set registry https://firewall.depthfirst.com/npm/
          else
            echo "No DF_FIREWALL_TOKEN (likely a fork PR); using the default public npm registry."
          fi

      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'
          registry-url: 'https://registry.npmjs.org'

      - name: Setup Deno
        uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5
        with:
          deno-version: v2.8.2

      - name: Export pinned Deno path
        run: echo "DENO_BIN_PATH=$(which deno)" >> "$GITHUB_ENV"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Configure git
        run: |
          git config --global user.name "supabase-releaser[bot]"
          git config --global user.email "supabase-releaser[bot]@users.noreply.github.com"

      - name: Release v3 next prerelease
        env:
          NPM_CONFIG_PROVENANCE: true
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          BASE_VERSION=$(cat .next-base-version | tr -d '[:space:]')
          echo "Publishing v3 next prerelease (base: ${BASE_VERSION})..."
          pnpm run release-canary -- --base-version "$BASE_VERSION" --preid next --tag next

      - name: Summary
        if: ${{ success() }}
        run: |
          echo "## ✅ Next Prerelease" >> $GITHUB_STEP_SUMMARY
          echo "- **Branch:** \`${GITHUB_REF_NAME}\`" >> $GITHUB_STEP_SUMMARY
          echo "- **Dist-tag:** \`next\`" >> $GITHUB_STEP_SUMMARY

  # preview jobs
  ci-core:
    if: ${{ github.event_name == 'push' }}
    name: Core Packages CI
    uses: ./.github/workflows/ci-core.yml
    permissions:
      actions: read
      contents: read
    secrets: inherit

  ci-supabase-js:
    if: ${{ github.event_name == 'push' }}
    name: Supabase-JS Integration CI
    uses: ./.github/workflows/ci-supabase-js.yml
    permissions:
      actions: read
      contents: read
    secrets: inherit

  # ==========================================
  # COVERALLS FINISH (aggregates coverage from all packages)
  # ==========================================

  coveralls-finish:
    name: Coveralls Finished
    runs-on: ubuntu-latest
    needs: [ci-core, ci-supabase-js]
    if: github.event_name == 'push'
    steps:
      - name: Coveralls Finished
        uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2.3.8
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          parallel-finished: true
          carryforward: 'auth-js,functions-js,postgrest-js,realtime-js,storage-js,supabase-js'
          fail-on-error: false
        continue-on-error: true

  # ==========================================
  # CANARY RELEASE (only on master, after all CI passes)
  # ==========================================

  release-canary:
    name: Release Prerelease
    runs-on: ubuntu-latest
    environment: npm-publish
    needs: [ci-core, ci-supabase-js]
    permissions:
      contents: read
      id-token: write
    concurrency:
      group: release-${{ github.ref }}
      cancel-in-progress: false
    outputs:
      partial_failure: ${{ steps.release.outputs.partial_failure }}
      partial_failure_reason: ${{ steps.release.outputs.partial_failure_reason }}
    # Run on master branch pushes, only if all CI jobs succeeded
    if: |
      github.event_name == 'push' &&
      github.ref == 'refs/heads/master' &&
      needs.ci-core.result == 'success' &&
      needs.ci-supabase-js.result == 'success'
    steps:
      - name: Generate token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ secrets.APP_CLIENT_ID }}
          private-key: ${{ secrets.PRIVATE_KEY }}

      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0

      - name: Configure Dependency Firewall registry
        shell: bash
        env:
          DF_FIREWALL_TOKEN: ${{ secrets.DF_FIREWALL_TOKEN }}
        run: |
          # The firewall token is withheld from fork-triggered PR runs, so only route
          # through the firewall when the token is present. Forks fall back to the
          # default public npm registry (install still uses --frozen-lockfile).
          if [ -n "$DF_FIREWALL_TOKEN" ]; then
            pnpm config set //firewall.depthfirst.com/npm/:_authToken "$DF_FIREWALL_TOKEN"
            pnpm config set registry https://firewall.depthfirst.com/npm/
          else
            echo "No DF_FIREWALL_TOKEN (likely a fork PR); using the default public npm registry."
          fi

      - name: Setup Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'
          registry-url: 'https://registry.npmjs.org'

      - name: Setup Deno
        uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5
        with:
          deno-version: v2.8.2

      - name: Export pinned Deno path
        run: echo "DENO_BIN_PATH=$(which deno)" >> "$GITHUB_ENV"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Configure git
        run: |
          git config --global user.name "supabase-releaser[bot]"
          git config --global user.email "supabase-releaser[bot]@users.noreply.github.com"

      - name: Release canary version
        id: release
        run: pnpm run release-canary
        env:
          NPM_CONFIG_PROVENANCE: true
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

  notify-stable-failure:
    name: Notify Slack for Stable failure
    needs: release-stable
    if: ${{ always() && github.event_name == 'workflow_dispatch' && needs.release-stable.result == 'failure' }}
    uses: ./.github/workflows/slack-notify.yml
    secrets:
      SLACK_CLIENT_LIBS_WEBHOOK: ${{ secrets.SLACK_CLIENT_LIBS_WEBHOOK }}
    with:
      title: 'Stable Release'
      status: 'failure'

  notify-stable-success:
    name: Notify Slack for Stable success
    needs: release-stable
    if: ${{ github.event_name == 'workflow_dispatch' && needs.release-stable.result == 'success' }}
    uses: ./.github/workflows/slack-notify.yml
    secrets:
      SLACK_CLIENT_LIBS_WEBHOOK: ${{ secrets.SLACK_CLIENT_LIBS_WEBHOOK }}
    with:
      title: 'Stable Release'
      status: 'success'
      version: ${{ needs.release-stable.outputs.released_version }}

  notify-canary-failure:
    name: Notify Slack for Canary failure
    needs: release-canary
    if: ${{ always() && github.event_name == 'push' && needs.release-canary.result == 'failure' }}
    uses: ./.github/workflows/slack-notify.yml
    secrets:
      SLACK_CLIENT_LIBS_WEBHOOK: ${{ secrets.SLACK_CLIENT_LIBS_WEBHOOK }}
    with:
      title: 'Canary Release'
      status: 'failure'

  # Fires when the canary job exits green but JSR or the gotrue-js legacy mirror
  # publish failed. release-canary.ts swallows those errors so npm canary still
  # ships; this notification ensures the breakage doesn't go silent for weeks.
  notify-canary-partial-failure:
    name: Notify Slack for Canary partial failure
    needs: release-canary
    if: ${{ always() && github.event_name == 'push' && needs.release-canary.result == 'success' && needs.release-canary.outputs.partial_failure == 'true' }}
    uses: ./.github/workflows/slack-notify.yml
    secrets:
      SLACK_CLIENT_LIBS_WEBHOOK: ${{ secrets.SLACK_CLIENT_LIBS_WEBHOOK }}
    with:
      title: 'Canary Release: partial publish failure (${{ needs.release-canary.outputs.partial_failure_reason }})'
      status: 'partial'

  notify-next-failure:
    name: Notify Slack for Next failure
    needs: release-next
    if: ${{ always() && github.event_name == 'workflow_dispatch' && needs.release-next.result == 'failure' }}
    uses: ./.github/workflows/slack-notify.yml
    secrets:
      SLACK_CLIENT_LIBS_WEBHOOK: ${{ secrets.SLACK_CLIENT_LIBS_WEBHOOK }}
    with:
      title: 'Next Prerelease'
      status: 'failure'

  notify-next-success:
    name: Notify Slack for Next success
    needs: release-next
    if: ${{ github.event_name == 'workflow_dispatch' && needs.release-next.result == 'success' }}
    uses: ./.github/workflows/slack-notify.yml
    secrets:
      SLACK_CLIENT_LIBS_WEBHOOK: ${{ secrets.SLACK_CLIENT_LIBS_WEBHOOK }}
    with:
      title: 'Next Prerelease'
      status: 'success'