ci-semantic-release-sync.yml

# Combined CI, Release, and Stage Sync Workflow
#
# This workflow automates the full CI/CD pipeline for the Cloudflare Worker monorepo using pnpm, git, and GitHub Actions.
#
# **Workflow Overview:**
#
# - **Triggers:**
#   - Runs on push and pull_request events for main, stage, and all common feature/maintenance branch globs (feature/**, bugfix/**, fix/**, hotfix/**, release/**, dependabot/**, renovate/**, chore/**, test/**).
#
# - **Jobs:**
#   1. **test**: Runs setup, install, and tests (via composite action) for all pushes and PRs. This is the base job for all other jobs.
#   2. **release**: Runs only on push to main, after test passes. Publishes a release using semantic-release and pushes to npm if configured.
#   3. **sync-stage-with-main**: Runs only on push to main, after a successful release. Attempts to fast-forward stage to main; if not possible, creates a PR from main to stage for manual review.
#
# **Logic Branching:**
#
# - All pushes and PRs trigger the test job for all important branches.
# - The release job only runs if the event is a push to main and test passes.
# - The sync-stage-with-main job only runs if the event is a push to main and the release job succeeds.
#   - If stage can be fast-forwarded to main, it does so and pushes.
#   - If not, it creates a PR from main to stage for manual review and merge.
#
# **Key Features:**
# - DRY: All setup/test logic is in a composite action.
# - Safe: Stage promotion is fast-forward only or via PR, never force-pushed.
# - Robust: Handles all common branch types and automates the full CI/CD lifecycle.
# - Minimal Redundancy: Only one test run per event, and downstream jobs depend on its success.
#
# See README.md for more details on branch management and promotion helpers.
#
# ---

# env
env:
  ACTIONS_STEP_DEBUG: true
  ACTIONS_RUNNER_DEBUG: true
  # RUN_TEST: ${{ inputs.RUN_TEST }}
  # RUN_BUILD: ${{ inputs.RUN_BUILD }}
  # RUN_LINT: ${{ inputs.RUN_LINT }}

name: CI, Semantic Release, and Stage Sync

on:
  workflow_dispatch:
  workflow_call:
    secrets:
      NPM_TOKEN:
        required: false
      NODE_AUTH_TOKEN:
        required: false
    inputs:
      RUN_TEST:
        required: false
        type: string
      RUN_BUILD:
        required: false
        type: string
      RUN_LINT:
        required: false
        type: string
      RUN_RELEASE:
        required: false
        type: string
        default: '1'

concurrency:
  group: ci-release-sync-${{ github.ref }}-${{ github.event_name }}-${{ github.run_id }}
  cancel-in-progress: true

jobs:
  test:
    name: Test & Build
    runs-on: ubuntu-latest
    concurrency:
      group: test-${{ github.ref }}
      cancel-in-progress: true
    steps:
      - name: Checkout code
        uses: actions/checkout@v5
      - name: Setup (CI & Build) and Test Package
        uses: variablesoftware/github-actions-node-setup-and-test@main
        # uses: ./.github/actions/setup-and-test
        env:
          RUN_TEST: ${{ inputs.RUN_TEST }}
          RUN_BUILD: ${{ inputs.RUN_BUILD }}
          RUN_LINT: ${{ inputs.RUN_LINT }}

  release:
    name: Release (main only)
    needs: test
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    runs-on: ubuntu-latest
    concurrency:
      group: release-${{ github.ref }}
      cancel-in-progress: true
    permissions:
      contents: write
      issues: write
      pull-requests: write
      id-token: write
    steps:
      - name: Debug workflow inputs
        run: |
          echo "RUN_TEST: ${{ inputs.RUN_TEST }}"
          echo "RUN_BUILD: ${{ inputs.RUN_BUILD }}"
          echo "RUN_LINT: ${{ inputs.RUN_LINT }}"
          echo "RUN_RELEASE: ${{ inputs.RUN_RELEASE }}"
      - name: Actions Checkout Code
        uses: actions/checkout@v5
      - name: Actions Set up Node.js
        uses: actions/setup-node@v5
        with:
          node-version: "lts/*"
      - name: PNPM Setup
        uses: pnpm/action-setup@v4
        with:
          version: latest
      - name: Debug pnpm environment
        run: |
          echo "PATH: $PATH"
          echo "NODE VERSION: $(node --version)"
          echo "NPM VERSION: $(npm --version)"
          echo "PNPM VERSION: $(pnpm --version)"
          which pnpm
          env | grep -E 'PNPM|NPM|NODE|PATH'
      - name: Install Dependencies
        run: pnpm install --frozen-lockfile
      - name: Debug GitHub Context
        run: |
          echo "GITHUB_CONTEXT VARIABLES:"
          echo "  github.ref: ${{ github.ref }}"
          echo "  github.ref_name: ${{ github.ref_name }}"
          echo "  github.repository: ${{ github.repository }}"
          echo "  github.repository_owner: ${{ github.repository_owner }}"
          echo "  github.event_name: ${{ github.event_name }}"
          echo "  github.sha: ${{ github.sha }}"
          echo "  github.actor: ${{ github.actor }}"
          echo "  github.workflow: ${{ github.workflow }}"
          echo "  github.run_id: ${{ github.run_id }}"
          echo "  github.run_number: ${{ github.run_number }}"
          echo "  github.head_ref: ${{ github.head_ref }}"
          echo "  github.base_ref: ${{ github.base_ref }}"
          echo "  github.job: ${{ github.job }}"
          echo "  github.workspace: ${{ github.workspace }}"
          echo "  github.action: ${{ github.action }}"
          echo "  github.triggering_actor: ${{ github.triggering_actor }}"
          echo "  github.server_url: ${{ github.server_url }}"
          echo "  github.api_url: ${{ github.api_url }}"
          echo "  github.graphql_url: ${{ github.graphql_url }}"
      - name: Run Semantic Release or Skip
        run: |
          if [ "${{ inputs.RUN_RELEASE }}" = "1" ]; then
            pnpm semantic-release
          else
            echo "Skipping semantic-release because RUN_RELEASE != 1"
          fi
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SCOPE: ${{ secrets.scope }}
          HUSKY: 0
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
          RUN_TEST: ${{ inputs.RUN_TEST }}
          RUN_BUILD: ${{ inputs.RUN_BUILD }}
          RUN_LINT: ${{ inputs.RUN_LINT }}
          RUN_RELEASE: ${{ inputs.RUN_RELEASE }}