release.yml

# pinact:skip-file — this workflow's action versions are pinned deliberately;
# changesets/action's `next` prereleases have repeatedly broken releases.
name: Release

on:
  push:
    branches:
      - main

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions: {}

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write # push release commits/tags and create GitHub releases
      id-token: write # OIDC for npm trusted publishing
    steps:
      - name: Checkout Repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          # Full history: changesets/action's changelog generation walks
          # commit history to attribute changesets, deepening a shallow
          # clone on demand if needed. That on-demand deepening is prone to
          # git-level races, so give it full history instead.
          fetch-depth: 0

      - name: Install Deps
        uses: ./.github/actions/install-deps

      - name: Get github access token for release PR / publish
        id: get_access_token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ secrets.TAILOR_GITHUB_APP_ID }}
          private-key: ${{ secrets.TAILOR_GITHUB_APP_PRIVATE_KEY }}
          repositories: ${{ github.event.repository.name }}
          permission-contents: write
          permission-pull-requests: write

      # pnpm v11's `runtime set node` no longer bundles npm, so PATH falls back
      # to the runner's system npm (10.8.2). Install npm 11+ into pnpm's global
      # prefix; pnpm/action-setup puts that prefix ahead of the system one.
      - name: Ensure npm 11+ for OIDC trusted publishing
        run: pnpm add -g npm@latest
        shell: bash

      # `--no-git-tag` skips @changesets/cli's own `git tag -m` (an annotated
      # tag, which needs a git identity we don't configure here). We create
      # tags and releases entirely through the `gh` API instead — see the
      # "Ensure GitHub releases" step below.
      - name: Create Release PR or Publish
        id: changesets
        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
        with:
          commitMode: "github-api"
          publish: "pnpm changeset publish --no-git-tag"
          createGithubReleases: false
        env:
          GITHUB_TOKEN: ${{ steps.get_access_token.outputs.token }}

      # Idempotent: creates a release (and its tag, via `gh release create
      # --target`) for every package version that doesn't have one yet, and
      # fails the job if creation fails — so a broken release step is caught
      # immediately instead of the gap going unnoticed.
      - name: Ensure GitHub releases exist for published packages
        env:
          GH_TOKEN: ${{ steps.get_access_token.outputs.token }}
        shell: bash
        run: bash ./.github/scripts/ensure-github-releases.sh

      - name: Notify Slack on failure
        if: failure()
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_SDK_WEBHOOK_URL }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          COMMIT_SHA: ${{ github.sha }}
        shell: bash
        run: |
          jq -n \
            --arg run "$RUN_URL" \
            --arg sha "$COMMIT_SHA" \
            '{text: ":rotating_light: Release workflow <\($run)|failed in \($sha[0:7])>"}' \
            | curl -fsS -X POST -H 'Content-Type: application/json' --data @- "$SLACK_WEBHOOK_URL"