release-node.yml

# Release Workflow — Node.js / TypeScript
#
# Triggers on GitHub Release or manual dispatch.
# Jobs: CI gate → version bump → social media announcements
#
# Setup: https://github.com/bgorzelic/release-kit/blob/main/docs/ONBOARDING.md
# Customize: https://github.com/bgorzelic/release-kit/blob/main/docs/CUSTOMIZATION.md

name: Release

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag (e.g. v1.0.0)'
        required: true

permissions:
  contents: write

jobs:
  # ─── CI Gate ────────────────────────────────────────────────────────
  ci-check:
    name: Verify CI
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          ref: main

      - uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'       # <<< CUSTOMIZE: or node-version: '20'
          cache: 'npm'                       # <<< CUSTOMIZE: or 'pnpm', 'yarn'

      - run: npm ci                          # <<< CUSTOMIZE: pnpm install, yarn install

      - name: Lint
        run: npx eslint --max-warnings 0 .   # <<< CUSTOMIZE: your lint command

      - name: Type Check
        run: npx tsc --noEmit                # <<< CUSTOMIZE: remove if not using TS

      - name: Test
        run: npm test                        # <<< CUSTOMIZE: npm run test:coverage, etc.

  # ─── Version Bump ──────────────────────────────────────────────────
  bump-version:
    name: Bump Version
    needs: ci-check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          ref: main
          token: ${{ secrets.GITHUB_TOKEN }}

      - uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
          cache: 'npm'

      - name: Update package.json to release tag
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name || inputs.tag }}
        run: |
          VERSION="${RELEASE_TAG#v}"
          if ! echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
            echo "::error::Invalid semver tag: $RELEASE_TAG"
            exit 1
          fi
          CURRENT="$(node -p "require('./package.json').version")"
          if [ "$CURRENT" = "$VERSION" ]; then
            echo "Version already at $VERSION, skipping"
            exit 0
          fi
          npm version "$VERSION" --no-git-tag-version

      - name: Commit version bump
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name || inputs.tag }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add package.json package-lock.json
          git diff --cached --quiet || git commit -m "chore: bump version to ${RELEASE_TAG}"
          git push

  # ─── Social Media Announcements ────────────────────────────────────
  # Each platform is an independent job. If secrets are missing, the
  # job skips gracefully. Add new platforms as additional jobs here.

  announce-twitter:
    name: Post to X/Twitter
    needs: bump-version
    if: ${{ github.event_name == 'release' && !github.event.release.prerelease }}
    runs-on: ubuntu-latest
    steps:
      - name: Check secrets
        id: check
        env:
          HAS_KEY: ${{ secrets.TWITTER_API_KEY }}
        run: |
          if [ -z "$HAS_KEY" ]; then
            echo "::warning::Twitter secrets not configured, skipping"
            echo "skip=true" >> "$GITHUB_OUTPUT"
          else
            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Compose and post
        if: steps.check.outputs.skip != 'true'
        env:
          TWITTER_API_KEY: ${{ secrets.TWITTER_API_KEY }}
          TWITTER_API_SECRET: ${{ secrets.TWITTER_API_SECRET }}
          TWITTER_ACCESS_TOKEN: ${{ secrets.TWITTER_ACCESS_TOKEN }}
          TWITTER_ACCESS_SECRET: ${{ secrets.TWITTER_ACCESS_SECRET }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
          RELEASE_URL: ${{ github.event.release.html_url }}
          REPO_NAME: ${{ github.event.repository.name }}
        run: |
          node -e '
          const crypto = require("crypto");
          const https = require("https");

          // <<< CUSTOMIZE: Edit the tweet text
          const tweetText = `${process.env.REPO_NAME} ${process.env.RELEASE_TAG} is live!\n\nRelease notes: ${process.env.RELEASE_URL}\n\n#buildinpublic #opensource`;

          const method = "POST";
          const url = "https://api.twitter.com/2/tweets";
          const consumerKey = process.env.TWITTER_API_KEY;
          const consumerSecret = process.env.TWITTER_API_SECRET;
          const accessToken = process.env.TWITTER_ACCESS_TOKEN;
          const accessSecret = process.env.TWITTER_ACCESS_SECRET;

          function percentEncode(s) {
            return encodeURIComponent(s).replace(/[!*()\x27]/g, c => "%" + c.charCodeAt(0).toString(16).toUpperCase());
          }

          const oauthParams = {
            oauth_consumer_key: consumerKey,
            oauth_nonce: crypto.randomBytes(16).toString("hex"),
            oauth_signature_method: "HMAC-SHA1",
            oauth_timestamp: Math.floor(Date.now() / 1000).toString(),
            oauth_token: accessToken,
            oauth_version: "1.0",
          };

          const paramString = Object.keys(oauthParams).sort()
            .map(k => percentEncode(k) + "=" + percentEncode(oauthParams[k]))
            .join("&");

          const sigBase = method + "&" + percentEncode(url) + "&" + percentEncode(paramString);
          const sigKey = percentEncode(consumerSecret) + "&" + percentEncode(accessSecret);
          const signature = crypto.createHmac("sha1", sigKey).update(sigBase).digest("base64");
          oauthParams.oauth_signature = signature;

          const authHeader = "OAuth " + Object.keys(oauthParams).sort()
            .map(k => percentEncode(k) + "=\"" + percentEncode(oauthParams[k]) + "\"")
            .join(", ");

          const body = JSON.stringify({ text: tweetText });

          const req = https.request(url, {
            method,
            headers: {
              Authorization: authHeader,
              "Content-Type": "application/json",
              "Content-Length": Buffer.byteLength(body),
            },
          }, res => {
            let data = "";
            res.on("data", chunk => data += chunk);
            res.on("end", () => {
              if (res.statusCode === 201) {
                const id = JSON.parse(data).data?.id;
                console.log("Tweet posted: https://x.com/i/status/" + id);
              } else {
                console.log("Twitter API " + res.statusCode + ": " + data);
                process.exit(1);
              }
            });
          });
          req.on("error", e => { console.error(e); process.exit(1); });
          req.write(body);
          req.end();
          '

  # ─── Future Platforms ──────────────────────────────────────────────
  # Uncomment and configure as platforms are added.
  #
  # announce-linkedin:
  #   name: Post to LinkedIn
  #   needs: bump-version
  #   if: ${{ github.event_name == 'release' && !github.event.release.prerelease }}
  #   runs-on: ubuntu-latest
  #   steps:
  #     - name: Check secrets
  #       id: check
  #       env:
  #         HAS_KEY: ${{ secrets.LINKEDIN_ACCESS_TOKEN }}
  #       run: |
  #         [ -z "$HAS_KEY" ] && echo "skip=true" >> "$GITHUB_OUTPUT" || echo "skip=false" >> "$GITHUB_OUTPUT"
  #     - name: Post to LinkedIn
  #       if: steps.check.outputs.skip != 'true'
  #       env:
  #         LINKEDIN_ACCESS_TOKEN: ${{ secrets.LINKEDIN_ACCESS_TOKEN }}
  #         LINKEDIN_ORG_ID: ${{ secrets.LINKEDIN_ORG_ID }}
  #         RELEASE_TAG: ${{ github.event.release.tag_name }}
  #         RELEASE_URL: ${{ github.event.release.html_url }}
  #         REPO_NAME: ${{ github.event.repository.name }}
  #       run: echo "LinkedIn posting — not yet implemented"
  #
  # announce-bluesky:
  #   name: Post to Bluesky
  #   needs: bump-version
  #   if: ${{ github.event_name == 'release' && !github.event.release.prerelease }}
  #   runs-on: ubuntu-latest
  #   steps:
  #     - name: Check secrets
  #       id: check
  #       env:
  #         HAS_KEY: ${{ secrets.BLUESKY_HANDLE }}
  #       run: |
  #         [ -z "$HAS_KEY" ] && echo "skip=true" >> "$GITHUB_OUTPUT" || echo "skip=false" >> "$GITHUB_OUTPUT"
  #     - name: Post to Bluesky
  #       if: steps.check.outputs.skip != 'true'
  #       env:
  #         BLUESKY_HANDLE: ${{ secrets.BLUESKY_HANDLE }}
  #         BLUESKY_APP_PASSWORD: ${{ secrets.BLUESKY_APP_PASSWORD }}
  #         RELEASE_TAG: ${{ github.event.release.tag_name }}
  #         RELEASE_URL: ${{ github.event.release.html_url }}
  #         REPO_NAME: ${{ github.event.repository.name }}
  #       run: echo "Bluesky posting — not yet implemented"