release.yml

name: Release Yield

on:
  workflow_dispatch:
    inputs:
      bump:
        description: Changeset bump, or an explicit higher bump
        type: choice
        options: [auto, patch, minor, major]
        default: auto
        required: true
      dry_run:
        description: Resolve and verify without tagging or publishing
        type: boolean
        default: false
        required: true
      notes_source:
        description: Source for the immutable GitHub release notes
        type: choice
        options: [changesets, git-history]
        default: changesets
        required: true

permissions:
  contents: read

concurrency:
  group: release-yield
  cancel-in-progress: false

jobs:
  plan:
    if: github.repository == 'operatorstack/yield'
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.plan.outputs.version }}
      tag: ${{ steps.plan.outputs.tag }}
      source_sha: ${{ steps.plan.outputs.source_sha }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: "24"
          cache: npm
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
          cache: true
      - name: Bind dispatch to protected main
        shell: bash
        run: |
          set -euo pipefail
          test "$GITHUB_REF" = refs/heads/main
          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
          test "$(git rev-parse origin/main)" = "$GITHUB_SHA"
      - run: npm ci --ignore-scripts
      - name: Verify release controller and source
        run: |
          npm run test:release
          node scripts/check-release-control.mjs
          go test ./...
          go build ./...
      - id: plan
        name: Resolve immutable release intent
        env:
          REQUESTED_BUMP: ${{ inputs.bump }}
          NOTES_SOURCE: ${{ inputs.notes_source }}
        run: >-
          node scripts/release-plan.mjs
          --bump "$REQUESTED_BUMP"
          --notes-source "$NOTES_SOURCE"
          --output "$GITHUB_OUTPUT"
          --notes "$RUNNER_TEMP/release-notes.md"
      - name: Report dry run
        if: inputs.dry_run
        env:
          TAG: ${{ steps.plan.outputs.tag }}
          VERSION: ${{ steps.plan.outputs.version }}
        run: |
          echo "### Dry run: $TAG" >> "$GITHUB_STEP_SUMMARY"
          echo "Version: $VERSION" >> "$GITHUB_STEP_SUMMARY"
          cat "$RUNNER_TEMP/release-notes.md" >> "$GITHUB_STEP_SUMMARY"
  release:
    needs: plan
    if: ${{ !inputs.dry_run }}
    runs-on: ubuntu-latest
    environment: release-control
    permissions:
      actions: write
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
          persist-credentials: false
          ref: ${{ needs.plan.outputs.source_sha }}
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: "24"
          cache: npm
      - run: npm ci --ignore-scripts
      - id: confirm
        name: Recompute release intent after approval
        env:
          REQUESTED_BUMP: ${{ inputs.bump }}
          NOTES_SOURCE: ${{ inputs.notes_source }}
        run: >-
          node scripts/release-plan.mjs
          --bump "$REQUESTED_BUMP"
          --notes-source "$NOTES_SOURCE"
          --output "$GITHUB_OUTPUT"
          --notes "$RUNNER_TEMP/release-notes.md"
      - name: Refuse plan drift
        env:
          EXPECTED_TAG: ${{ needs.plan.outputs.tag }}
          EXPECTED_VERSION: ${{ needs.plan.outputs.version }}
          ACTUAL_TAG: ${{ steps.confirm.outputs.tag }}
          ACTUAL_VERSION: ${{ steps.confirm.outputs.version }}
        run: |
          test "$ACTUAL_TAG" = "$EXPECTED_TAG"
          test "$ACTUAL_VERSION" = "$EXPECTED_VERSION"
      - name: Create immutable tag and draft release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ steps.confirm.outputs.tag }}
        shell: bash
        run: |
          set -euo pipefail
          if git ls-remote --exit-code --tags origin "refs/tags/$TAG" >/dev/null 2>&1; then
            echo "Tag $TAG already exists" >&2
            exit 1
          fi
          gh api --method POST "repos/$GITHUB_REPOSITORY/git/refs" \
            -f ref="refs/tags/$TAG" \
            -f sha="$GITHUB_SHA"
          gh release create "$TAG" \
            --repo "$GITHUB_REPOSITORY" \
            --title "$TAG" \
            --notes-file "$RUNNER_TEMP/release-notes.md" \
            --draft \
            --verify-tag
      - name: Dispatch the protected package publisher
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ steps.confirm.outputs.version }}
        run: gh workflow run npm-publish.yml --repo "$GITHUB_REPOSITORY" --ref main -f version="$VERSION"