release-please.yml

name: Release Please

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      dry_run:
        description: Dry run — build binaries but skip npm publish
        type: boolean
        default: false

jobs:
  # -------------------------------------------------------------------------
  # Job 1: Create / update release PR (push to main only)
  # -------------------------------------------------------------------------
  release-please:
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      id-token: write
    outputs:
      releases_created: ${{ steps.release.outputs.releases_created }}
      paths_released: ${{ steps.release.outputs.paths_released }}
      soop_release_created: ${{ steps.release.outputs['packages/soop--release_created'] }}
      soop_tag_name: ${{ steps.release.outputs['packages/soop--tag_name'] }}
      soop_native_release_created: ${{ steps.release.outputs['packages/soop-native--release_created'] }}
      soop_native_tag_name: ${{ steps.release.outputs['packages/soop-native--tag_name'] }}
    steps:
      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
          client-id: ${{ secrets.CLIENT_ID }}
          private-key: ${{ secrets.PRIVATE_KEY }}
      - uses: googleapis/release-please-action@v5
        id: release
        with:
          token: ${{ steps.app-token.outputs.token }}
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json

      # Update bun.lock — release-please bumps package.json versions
      # but does not regenerate the lockfile
      - uses: actions/checkout@v6
        if: steps.release.outputs.pr && !steps.release.outputs.release_created
        with:
          token: ${{ steps.app-token.outputs.token }}
          ref: release-please--branches--main

      - uses: oven-sh/setup-bun@v2
        if: steps.release.outputs.pr && !steps.release.outputs.release_created

      - name: Update bun.lock in release PR
        if: steps.release.outputs.pr && !steps.release.outputs.release_created
        run: |
          bun install
          if git diff --quiet bun.lock; then
            echo "bun.lock is already up to date"
            exit 0
          fi
          git config user.name "pleaseai-bot[bot]"
          git config user.email "239696668+pleaseai-bot[bot]@users.noreply.github.com"
          git add bun.lock
          git commit -m "chore: update bun.lock"
          git push

  # -------------------------------------------------------------------------
  # Job 2: Build all platform binaries and publish to npm
  #
  # A single ubuntu-latest runner cross-compiles all 7 targets with `bun compile`.
  # The native tree-sitter pack (@kreuzberg/tree-sitter-language-pack) is externalized
  # from the compiled binaries — it is resolved at runtime from the host's npm install
  # (`bun install -g @pleaseai/soop`), which fetches the matching prebuilt .node.
  # Prebuilds exist for darwin-x64/arm64, linux-x64/arm64-gnu, win-x64/arm64; there is
  # no musl prebuild, so AST parsing on a musl host requires a glibc environment.
  #
  # Runs when:
  #   - push: release was created by release-please
  #   - workflow_dispatch: always (manual trigger)
  # -------------------------------------------------------------------------
  publish:
    needs: release-please
    if: |
      always() && (
        (github.event_name == 'push' &&
          needs.release-please.result == 'success' &&
          (needs.release-please.outputs.soop_release_created == 'true' ||
           needs.release-please.outputs.soop_native_release_created == 'true')) ||
        github.event_name == 'workflow_dispatch'
      )
    runs-on: ubuntu-latest
    env:
      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
      TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
    permissions:
      contents: read
      id-token: write # Required for npm OIDC trusted publishing
    steps:
      - uses: actions/checkout@v6
      - uses: oven-sh/setup-bun@v2
      - uses: actions/setup-node@v6
        with:
          node-version-file: .nvmrc
          registry-url: 'https://registry.npmjs.org'

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build main package
        run: bun run build

      - name: Verify build artifacts exist
        run: |
          for f in \
            packages/soop/dist/packages/cli/src/cli.mjs \
            packages/soop/dist/src/index.mjs \
            packages/soop/dist/src/index.d.mts; do
            if [ ! -f "$f" ]; then
              echo "ERROR: Missing required artifact: $f"
              exit 1
            fi
          done
          echo "All required artifacts present."

      - name: Build all platform binaries
        run: bun run scripts/generate-packages.ts

      - name: List collected packages
        run: ls -la npm/

      # Publish platform packages first — main package references them via optionalDependencies
      - name: Publish platform packages
        if: ${{ github.event.inputs.dry_run != 'true' }}
        run: |
          for dir in npm/soop-*/; do
            name=$(cat "$dir/package.json" | python3 -c "import json,sys; print(json.load(sys.stdin)['name'])")
            version=$(cat "$dir/package.json" | python3 -c "import json,sys; print(json.load(sys.stdin)['version'])")
            if npm view "${name}@${version}" version 2>/dev/null | grep -q "${version}"; then
              echo "Skipping $name@$version (already published)"
            else
              echo "Publishing $dir..."
              tarball=$(cd "$dir" && bun pm pack | grep '\.tgz$')
              (cd "$dir" && npm publish "./$tarball" --access public --provenance)
            fi
          done
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      # Publish @pleaseai/soop-native package (platform binary launcher)
      - name: Publish soop-native package
        if: ${{ github.event.inputs.dry_run != 'true' }}
        run: |
          name=$(cat packages/soop-native/package.json | python3 -c "import json,sys; print(json.load(sys.stdin)['name'])")
          version=$(cat packages/soop-native/package.json | python3 -c "import json,sys; print(json.load(sys.stdin)['version'])")
          if npm view "${name}@${version}" version 2>/dev/null | grep -q "${version}"; then
            echo "Skipping ${name}@${version} (already published)"
          else
            tarball=$(cd packages/soop-native && bun pm pack | grep '\.tgz$')
            (cd packages/soop-native && npm publish "./$tarball" --access public --provenance)
          fi
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      # Publish main @pleaseai/soop package (OIDC trusted publishing — no token needed)
      - name: Publish main package
        if: ${{ github.event.inputs.dry_run != 'true' }}
        run: |
          name=$(cat packages/soop/package.json | python3 -c "import json,sys; print(json.load(sys.stdin)['name'])")
          version=$(cat packages/soop/package.json | python3 -c "import json,sys; print(json.load(sys.stdin)['version'])")
          if npm view "${name}@${version}" version 2>/dev/null | grep -q "${version}"; then
            echo "Skipping ${name}@${version} (already published)"
          else
            tarball=$(cd packages/soop && bun pm pack | grep '\.tgz$')
            (cd packages/soop && npm publish "./$tarball" --access public --provenance)
          fi

      # Dry run — show what would be published
      - name: Dry run summary
        if: ${{ github.event.inputs.dry_run == 'true' }}
        run: |
          echo "=== DRY RUN: packages that would be published ==="
          for dir in npm/soop-*/; do
            name=$(cat "$dir/package.json" | python3 -c "import json,sys; print(json.load(sys.stdin)['name'])")
            version=$(cat "$dir/package.json" | python3 -c "import json,sys; print(json.load(sys.stdin)['version'])")
            echo "  $name@$version"
          done
          echo "  @pleaseai/soop-native (native launcher package)"
          echo "  @pleaseai/soop (main package)"