release.yml

name: Release

on:
  push:
    branches:
      - main
  workflow_dispatch:

concurrency: ${{ github.workflow }}-${{ github.ref }}

jobs:
  check-release:
    name: Check for new version
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
    outputs:
      should_release: ${{ steps.check.outputs.should_release }}
      needs_github_release: ${{ steps.check.outputs.needs_github_release }}
      version: ${{ steps.check.outputs.version }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      - name: Compare package.json version to npm and check GitHub release
        id: check
        run: |
          LOCAL_VERSION=$(node -p "require('./packages/native-sdk/package.json').version")
          echo "Local version: $LOCAL_VERSION"

          NPM_VERSION=$(npm view @native-sdk/cli version 2>/dev/null || echo "0.0.0")
          echo "npm version: $NPM_VERSION"

          if [ "$LOCAL_VERSION" != "$NPM_VERSION" ]; then
            echo "Version changed: $NPM_VERSION -> $LOCAL_VERSION"
            echo "should_release=true" >> "$GITHUB_OUTPUT"
            echo "needs_github_release=true" >> "$GITHUB_OUTPUT"
          else
            echo "Version unchanged on npm, skipping publish"
            echo "should_release=false" >> "$GITHUB_OUTPUT"

            TAG="v$LOCAL_VERSION"
            EXISTING_ASSETS=$(gh release view "$TAG" --json assets --jq '.assets[].name' 2>/dev/null || true)
            missing=0
            for asset in \
              CHECKSUMS.txt \
              native-sdk-darwin-arm64 \
              native-sdk-darwin-x64 \
              native-sdk-linux-arm64 \
              native-sdk-linux-x64 \
              native-sdk-linux-musl-arm64 \
              native-sdk-linux-musl-x64 \
              native-sdk-win32-arm64.exe \
              native-sdk-win32-x64.exe
            do
              if ! printf '%s\n' "$EXISTING_ASSETS" | grep -Fx "$asset" >/dev/null; then
                echo "Missing release asset: $asset"
                missing=1
              fi
            done

            if [ "$missing" -eq 0 ]; then
              echo "GitHub release $TAG exists with native assets"
              echo "needs_github_release=false" >> "$GITHUB_OUTPUT"
            else
              echo "GitHub release $TAG is missing native assets, will create/update it"
              echo "needs_github_release=true" >> "$GITHUB_OUTPUT"
            fi
          fi

          echo "version=$LOCAL_VERSION" >> "$GITHUB_OUTPUT"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  github-release:
    name: Create GitHub Release
    needs: check-release
    if: needs.check-release.outputs.needs_github_release == 'true'
    runs-on: macos-14
    timeout-minutes: 10
    permissions:
      contents: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Zig
        uses: vercel-labs/setup-zig@v1
        with:
          version: 0.16.0

      - name: Extract changelog entry
        run: |
          VERSION="${{ needs.check-release.outputs.version }}"
          awk '/<!-- release:start -->/{found=1; next} /<!-- release:end -->/{exit} found{print}' CHANGELOG.md > /tmp/release-notes.md

          LINES=$(wc -l < /tmp/release-notes.md | tr -d ' ')
          if [ "$LINES" -lt 2 ]; then
            echo "Error: No release notes found between <!-- release:start --> and <!-- release:end --> markers in CHANGELOG.md"
            exit 1
          fi
          echo "Extracted release notes for $VERSION ($LINES lines)"

      - name: Build native release assets (all platforms)
        run: |
          # Cross-compiles the CLI for all eight platforms and writes the
          # flat release assets + CHECKSUMS.txt into zig-out/release/.
          bash packages/native-sdk/scripts/build-binaries.sh

      - name: Create GitHub Release
        run: |
          VERSION="${{ needs.check-release.outputs.version }}"
          TAG="v$VERSION"

          if gh release view "$TAG" &>/dev/null; then
            echo "Release $TAG already exists, updating assets"
          else
            echo "Creating release $TAG..."
            gh release create "$TAG" \
              --title "$TAG" \
              --notes-file /tmp/release-notes.md
          fi

          gh release upload "$TAG" \
            zig-out/release/native-sdk-* \
            zig-out/release/CHECKSUMS.txt \
            --clobber
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  publish:
    name: Publish CLI to npm
    needs: [check-release, github-release]
    if: >-
      always()
      && needs.check-release.outputs.should_release == 'true'
      && (needs.github-release.result == 'success' || needs.github-release.result == 'skipped')
    runs-on: ubuntu-latest
    timeout-minutes: 15
    environment: Release
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"

      # Publishing uses npm trusted publishing (OIDC): the job's id-token
      # permission lets npm mint short-lived credentials, so no npm token
      # secret exists anywhere in this repo. All nine packages —
      # @native-sdk/cli plus the eight @native-sdk/cli-* platform packages
      # under packages/native-sdk/npm/ — must each be configured on
      # npmjs.com with a GitHub Actions trusted publisher pointing at
      # repository vercel-labs/native, workflow release.yml,
      # environment Release. If a package is missing that configuration,
      # npm publish fails loudly with an OIDC authentication error before
      # anything is uploaded for that package. Trusted publishing requires
      # npm >= 11.5.1, satisfied by the npm bundled with Node 24.
      # @native-sdk/core (packages/core) joins that publish set the moment
      # its "private" flag drops (see the publish step below) — its
      # npmjs.com trusted-publisher configuration must exist BEFORE that
      # flip lands.

      - name: Check version sync
        run: npm --prefix packages/native-sdk run version:check

      - name: Check package scripts
        run: npm --prefix packages/native-sdk run scripts:check

      - name: Download release binaries
        run: |
          VERSION="${{ needs.check-release.outputs.version }}"
          mkdir -p /tmp/native-sdk-release
          gh release download "v$VERSION" \
            --pattern 'native-sdk-*' \
            --pattern 'CHECKSUMS.txt' \
            --dir /tmp/native-sdk-release
          (cd /tmp/native-sdk-release && sha256sum -c CHECKSUMS.txt)
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Stage binaries into the platform packages
        run: |
          # Release-asset name -> npm platform package (same table as
          # packages/native-sdk/scripts/build-binaries.sh).
          stage() {
            asset="$1"; key="$2"; ext="$3"
            mkdir -p "packages/native-sdk/npm/$key/bin"
            cp "/tmp/native-sdk-release/$asset" "packages/native-sdk/npm/$key/bin/native$ext"
            chmod 755 "packages/native-sdk/npm/$key/bin/native$ext"
          }
          stage native-sdk-darwin-arm64 darwin-arm64 ""
          stage native-sdk-darwin-x64 darwin-x64 ""
          stage native-sdk-linux-arm64 linux-arm64-gnu ""
          stage native-sdk-linux-x64 linux-x64-gnu ""
          stage native-sdk-linux-musl-arm64 linux-arm64-musl ""
          stage native-sdk-linux-musl-x64 linux-x64-musl ""
          stage native-sdk-win32-arm64.exe win32-arm64 ".exe"
          stage native-sdk-win32-x64.exe win32-x64 ".exe"

      - name: Publish to npm
        run: |
          VERSION="${{ needs.check-release.outputs.version }}"

          # Platform packages first, so the main package's
          # optionalDependencies pins are resolvable the moment it lands.
          # Re-runs skip anything already on the registry at this version.
          publish_dir() {
            dir="$1"
            name=$(node -p "require('./$dir/package.json').name")
            if npm view "$name@$VERSION" version >/dev/null 2>&1; then
              echo "$name@$VERSION already published, skipping"
              return 0
            fi
            (cd "$dir" && npm publish --provenance --access public)
          }

          for dir in packages/native-sdk/npm/*/; do
            publish_dir "${dir%/}"
          done

          # @native-sdk/core (packages/core) rides the same version and
          # release gate as the CLI (sync-version.js stamps it; the
          # version check above refuses a half-bumped tree).
          #
          # ============================ LOUD FLIP REQUIREMENT ==========
          # packages/core/package.json keeps "private": true until the
          # 0.5.0 cut BY DESIGN, and that field IS the publish switch:
          # while private, the guard below skips the package (npm would
          # refuse to publish it anyway); the 0.5.0 change that drops
          # "private" makes this same step start publishing it with no
          # workflow edit. Before dropping the flag, configure the
          # @native-sdk/core trusted publisher on npmjs.com (see the note
          # above) or the first public release fails here.
          # =============================================================
          if [ "$(node -p "require('./packages/core/package.json').private === true")" = "true" ]; then
            echo "@native-sdk/core is private (pre-0.5.0): skipping publish by design"
          else
            publish_dir packages/core
          fi

          publish_dir packages/native-sdk