release.yml

name: "Release"

on:
  pull_request:
    types: [closed]
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

# Concurrency control: only one release process can run at a time
# This prevents race conditions if multiple PRs with 'release' label merge simultaneously
concurrency:
  group: release
  cancel-in-progress: false

jobs:
  check-changesets:
    name: Check for changesets
    runs-on: ubuntu-latest
    if: |
      github.event_name == 'workflow_dispatch' ||
      (github.event_name == 'pull_request' &&
       github.event.pull_request.merged == true &&
       contains(github.event.pull_request.labels.*.name, 'release'))
    outputs:
      has-changesets: ${{ steps.check.outputs.has-changesets }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          ref: main
          fetch-depth: 0

      - name: Check for changesets
        id: check
        run: |
          if [ ! -d ".changeset" ] || [ -z "$(ls -A .changeset/*.md 2>/dev/null | grep -v README.md)" ]; then
            echo "❌ No changesets found. Cannot proceed with release."
            echo "Please ensure your PR includes a changeset file."
            echo "has-changesets=false" >> "$GITHUB_OUTPUT"
          else
            echo "✓ Found changesets to process"
            echo "has-changesets=true" >> "$GITHUB_OUTPUT"
          fi

  notify-approval-needed:
    name: Notify Slack - Approval Needed
    needs: check-changesets
    if: needs.check-changesets.outputs.has-changesets == 'true'
    uses: posthog/.github/.github/workflows/notify-approval-needed.yml@main
    with:
      slack_channel_id: ${{ vars.SLACK_APPROVALS_CLIENT_LIBRARIES_CHANNEL_ID }}
      slack_user_group_id: ${{ vars.GROUP_CLIENT_LIBRARIES_SLACK_GROUP_ID }}
    secrets:
      slack_bot_token: ${{ secrets.SLACK_CLIENT_LIBRARIES_BOT_TOKEN }}
      posthog_project_api_key: ${{ secrets.POSTHOG_PROJECT_API_KEY }}

  version-bump:
    name: Bump version and commit to main
    needs: [check-changesets, notify-approval-needed]
    runs-on: ubuntu-latest
    if: always() && needs.check-changesets.outputs.has-changesets == 'true'
    environment: "Release"
    permissions:
      contents: write
    outputs:
      commit-hash: ${{ steps.commit-version-bump.outputs.commit-hash }}
      new-version: ${{ steps.apply-changesets.outputs.new-version }}
    steps:
      - name: Notify Slack - Approved
        if: needs.notify-approval-needed.outputs.slack_ts != ''
        uses: posthog/.github/.github/actions/slack-thread-reply@main
        with:
          slack_bot_token: ${{ secrets.SLACK_CLIENT_LIBRARIES_BOT_TOKEN }}
          slack_channel_id: ${{ vars.SLACK_APPROVALS_CLIENT_LIBRARIES_CHANNEL_ID }}
          thread_ts: ${{ needs.notify-approval-needed.outputs.slack_ts }}
          message: "✅ Release approved! Version bump in progress..."
          emoji_reaction: "white_check_mark"

      - name: Get GitHub App token
        id: releaser
        uses: actions/create-github-app-token@v3
        with:
          client-id: ${{ secrets.GH_APP_POSTHOG_RUBY_RELEASER_APP_ID }}
          private-key: ${{ secrets.GH_APP_POSTHOG_RUBY_RELEASER_PRIVATE_KEY }}

      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          ref: main
          fetch-depth: 0
          token: ${{ steps.releaser.outputs.token }}

      - name: Configure Git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Set up pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
        with:
          version: 10.33.0

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm

      - name: Install changesets dependencies
        run: pnpm install --frozen-lockfile

      - name: Apply changesets and update version
        id: apply-changesets
        run: |
          pnpm changeset version
          NEW_VERSION=$(node -p "require('./package.json').version")
          echo "new-version=$NEW_VERSION" >> "$GITHUB_OUTPUT"
          echo "New version: $NEW_VERSION"

      - name: Sync version to Ruby files
        env:
          NEW_VERSION: ${{ steps.apply-changesets.outputs.new-version }}
        run: ./scripts/bump-version.sh "$NEW_VERSION"

      - name: Set up Ruby
        uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
        with:
          ruby-version: ruby

      - name: Update Gemfile.lock
        run: bundle lock

      - name: Commit version bump
        id: commit-version-bump
        uses: planetscale/ghcommit-action@25309d8005ac7c3bcd61d3fe19b69e0fe47dbdde # v0.2.20
        with:
          commit_message: "chore: release ${{ steps.apply-changesets.outputs.new-version }} [version bump]"
          repo: ${{ github.repository }}
          branch: main
        env:
          GITHUB_TOKEN: ${{ steps.releaser.outputs.token }}

      - name: Notify Slack - Failed
        if: ${{ failure() && needs.notify-approval-needed.outputs.slack_ts != '' }}
        uses: posthog/.github/.github/actions/slack-thread-reply@main
        with:
          slack_bot_token: ${{ secrets.SLACK_CLIENT_LIBRARIES_BOT_TOKEN }}
          slack_channel_id: ${{ vars.SLACK_APPROVALS_CLIENT_LIBRARIES_CHANNEL_ID }}
          thread_ts: ${{ needs.notify-approval-needed.outputs.slack_ts }}
          message: "❌ Failed to bump version for `posthog-ruby@${{ steps.apply-changesets.outputs.new-version }}`! <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|View logs>"
          emoji_reaction: "x"

  notify-rejected:
    name: Notify Slack - Rejected
    needs: [version-bump, notify-approval-needed]
    runs-on: ubuntu-latest
    if: always() && needs.version-bump.result == 'failure' && needs.notify-approval-needed.outputs.slack_ts != ''
    steps:
      - name: Check for rejection
        id: check-rejection
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          RESPONSE=$(gh api /repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/approvals)
          REJECTED=$(echo "$RESPONSE" | jq '[.[] | select(.state == "rejected")] | length')
          if [ "$REJECTED" -gt 0 ]; then
            echo "was_rejected=true" >> "$GITHUB_OUTPUT"
            COMMENT=$(echo "$RESPONSE" | jq -r '.[] | select(.state == "rejected") | .comment // empty' | head -1)
            if [ -n "$COMMENT" ]; then
              {
                echo 'message<<EOF'
                echo "🚫 Release was rejected: $COMMENT"
                echo 'EOF'
              } >> "$GITHUB_OUTPUT"
            else
              echo "message=🚫 Release was rejected." >> "$GITHUB_OUTPUT"
            fi
          else
            echo "was_rejected=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Notify Slack - Rejected
        if: steps.check-rejection.outputs.was_rejected == 'true'
        uses: posthog/.github/.github/actions/slack-thread-reply@main
        with:
          slack_bot_token: ${{ secrets.SLACK_CLIENT_LIBRARIES_BOT_TOKEN }}
          slack_channel_id: ${{ vars.SLACK_APPROVALS_CLIENT_LIBRARIES_CHANNEL_ID }}
          thread_ts: ${{ needs.notify-approval-needed.outputs.slack_ts }}
          message: '${{ steps.check-rejection.outputs.message }}'
          emoji_reaction: "no_entry_sign"

  publish:
    name: Release and publish
    needs: [version-bump, notify-approval-needed]
    runs-on: ubuntu-latest
    if: always() && needs.version-bump.outputs.commit-hash != ''
    permissions:
      contents: write
      id-token: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          ref: main
          fetch-depth: 0

      - name: Configure Git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Set up Ruby
        uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
        with:
          bundler-cache: true
          ruby-version: ruby

      - name: Configure trusted publishing credentials
        uses: rubygems/configure-rubygems-credentials@bc6dd217f8a4f919d6835fcfefd470ef821f5c44 # v1.0.0

      - name: Build posthog-ruby
        run: gem build posthog-ruby.gemspec

      - name: Publish posthog-ruby
        run: gem push posthog-ruby-*.gem

      - name: Wait for posthog-ruby to be available
        run: gem exec rubygems-await posthog-ruby-*.gem

      - name: Build posthog-rails
        run: gem build posthog-rails.gemspec
        working-directory: posthog-rails

      - name: Publish posthog-rails
        run: gem push posthog-rails/posthog-rails-*.gem

      - name: Wait for posthog-rails to be available
        run: gem exec rubygems-await posthog-rails/posthog-rails-*.gem

      - name: Tag repository
        env:
          NEW_VERSION: ${{ needs.version-bump.outputs.new-version }}
          COMMIT_HASH: ${{ needs.version-bump.outputs.commit-hash }}
        run: |
          git tag -a "$NEW_VERSION" "$COMMIT_HASH" -m "$NEW_VERSION"
          git push origin "$NEW_VERSION"

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          NEW_VERSION: ${{ needs.version-bump.outputs.new-version }}
        run: |
          gh release create "$NEW_VERSION" \
            --title "$NEW_VERSION" \
            --generate-notes

      - name: Send failure event to PostHog
        if: ${{ failure() }}
        uses: PostHog/posthog-github-action@v1
        with:
          posthog-token: "${{ secrets.POSTHOG_PROJECT_API_KEY }}"
          event: "posthog-ruby-github-release-workflow-failure"
          properties: >-
            {
              "commitSha": "${{ github.sha }}",
              "jobStatus": "${{ job.status }}",
              "ref": "${{ github.ref }}",
              "version": "${{ needs.version-bump.outputs.new-version }}"
            }

      - name: Notify Slack - Failed
        if: ${{ failure() && needs.notify-approval-needed.outputs.slack_ts != '' }}
        uses: posthog/.github/.github/actions/slack-thread-reply@main
        with:
          slack_bot_token: ${{ secrets.SLACK_CLIENT_LIBRARIES_BOT_TOKEN }}
          slack_channel_id: ${{ vars.SLACK_APPROVALS_CLIENT_LIBRARIES_CHANNEL_ID }}
          thread_ts: ${{ needs.notify-approval-needed.outputs.slack_ts }}
          message: "❌ Failed to release `posthog-ruby@${{ needs.version-bump.outputs.new-version }}`! <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|View logs>"
          emoji_reaction: "x"

  notify-released:
    name: Notify Slack - Released
    needs: [version-bump, publish, notify-approval-needed]
    runs-on: ubuntu-latest
    if: always() && needs.publish.result == 'success' && needs.notify-approval-needed.outputs.slack_ts != ''
    steps:
      - name: Notify Slack - Released
        uses: posthog/.github/.github/actions/slack-thread-reply@main
        with:
          slack_bot_token: ${{ secrets.SLACK_CLIENT_LIBRARIES_BOT_TOKEN }}
          slack_channel_id: ${{ vars.SLACK_APPROVALS_CLIENT_LIBRARIES_CHANNEL_ID }}
          thread_ts: ${{ needs.notify-approval-needed.outputs.slack_ts }}
          message: "🚀 posthog-ruby and posthog-rails ${{ needs.version-bump.outputs.new-version }} released successfully!"
          emoji_reaction: "rocket"