release.yml

name: Release npm and Pages

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
    inputs:
      release_tag:
        description: Existing immutable release tag to resume
        required: true
        type: string

concurrency:
  group: capability-graph-production
  cancel-in-progress: false
  queue: max

permissions:
  contents: read

jobs:
  freeze:
    runs-on: ubuntu-latest
    outputs:
      release_id: ${{ steps.contract.outputs.release_id }}
      release_tag: ${{ steps.contract.outputs.release_tag }}
      release_commit: ${{ steps.contract.outputs.release_commit }}
      package_version: ${{ steps.contract.outputs.package_version }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && github.sha || github.ref }}
          fetch-depth: 0
          persist-credentials: false
      - id: target
        name: Resolve the immutable release tag
        shell: bash
        env:
          RELEASE_TAG: ${{ github.event.inputs.release_tag || github.ref_name }}
        run: |
          set -euo pipefail
          git fetch --force origin "refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"
          release_commit="$(git rev-parse "refs/tags/$RELEASE_TAG^{commit}")"
          echo "release_commit=$release_commit" >>"$GITHUB_OUTPUT"
      - uses: actions/setup-node@v7
        with:
          node-version: "22.12.0"
      - id: contract
        run: node website/scripts/check-release.mjs
        env:
          RELEASE_TAG: ${{ github.event.inputs.release_tag || github.ref_name }}
          RELEASE_COMMIT: ${{ steps.target.outputs.release_commit }}
      - name: Require the tag commit to belong to main
        shell: bash
        run: |
          set -euo pipefail
          git fetch --no-tags origin main:refs/remotes/origin/main
          release_commit="${{ steps.target.outputs.release_commit }}"
          git merge-base --is-ancestor "$release_commit" origin/main || {
            echo "${{ github.event.inputs.release_tag || github.ref_name }} must point to a commit reachable from main" >&2
            exit 1
          }

  gates:
    needs: freeze
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && github.sha || github.ref }}
          persist-credentials: false
      - uses: actions/setup-node@v7
        with:
          node-version: "22.12.0"
          cache: npm
          cache-dependency-path: |
            package-lock.json
            website/package-lock.json
      - run: npm ci
      - run: npm test
      - run: npm run test:package
      - run: npm run evaluate
      - run: npm ci --ignore-scripts
        working-directory: examples/seed-mcp
      - run: npm test
        working-directory: examples/seed-mcp
      - run: npm ci
        working-directory: website
      - run: npx playwright install --with-deps chromium
        working-directory: website
      - run: npm run check
        working-directory: website
      - run: npm run build:ai
        working-directory: website

  package:
    needs: [freeze, gates]
    runs-on: ubuntu-latest
    environment: npm-production
    permissions:
      contents: read
      id-token: write
    env:
      PACKAGE_VERSION: ${{ needs.freeze.outputs.package_version }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && github.sha || github.ref }}
          persist-credentials: false
      - uses: actions/setup-node@v7
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"
      - run: npm install --global npm@11.15.0
      - run: npm ci
      - run: npm run build
      - id: pack
        name: Build the immutable package artifact
        shell: bash
        run: |
          set -euo pipefail
          npm pack --json >pack.json
          filename="$(node --input-type=module --eval "import fs from 'node:fs'; const [pack]=JSON.parse(fs.readFileSync('pack.json')); console.log(pack.filename)")"
          shasum="$(node --input-type=module --eval "import fs from 'node:fs'; const [pack]=JSON.parse(fs.readFileSync('pack.json')); console.log(pack.shasum)")"
          echo "filename=$filename" >>"$GITHUB_OUTPUT"
          echo "shasum=$shasum" >>"$GITHUB_OUTPUT"
      - id: registry
        name: Reject duplicate, stale or divergent releases
        shell: bash
        run: |
          set -euo pipefail
          name="@devcodex/capability-graph"
          package="${name}@${PACKAGE_VERSION}"
          if npm view "$name" name --json >package-view.json 2>package-error.log; then
            package_exists=true
            if ! latest="$(npm view "$name" dist-tags.latest 2>latest-error.log)"; then
              cat latest-error.log >&2
              exit 1
            fi
          elif grep -q 'E404' package-error.log; then
            package_exists=false
            latest=""
          else
            cat package-error.log >&2
            exit 1
          fi
          if npm view "$package" dist.shasum --json >version.json 2>registry-error.log; then
            version_exists=true
            published_shasum="$(node --input-type=module --eval "import fs from 'node:fs'; console.log(JSON.parse(fs.readFileSync('version.json')))")"
            if [[ "$published_shasum" != "${{ steps.pack.outputs.shasum }}" ]]; then
              echo "$package exists with a different tarball; refusing to continue" >&2
              exit 1
            fi
            if [[ "$latest" != "$PACKAGE_VERSION" ]]; then
              echo "$package is not npm latest ($latest); this release is stale" >&2
              exit 1
            fi
          elif grep -q 'E404' registry-error.log; then
            version_exists=false
            node website/scripts/check-release-order.mjs "$PACKAGE_VERSION" "$latest"
          else
            cat registry-error.log >&2
            exit 1
          fi
          echo "package_exists=$package_exists" >>"$GITHUB_OUTPUT"
          echo "version_exists=$version_exists" >>"$GITHUB_OUTPUT"
      - name: Publish the first version with the bootstrap token
        if: steps.registry.outputs.version_exists == 'false' && steps.registry.outputs.package_exists == 'false'
        shell: bash
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          set -euo pipefail
          if [[ -z "${NODE_AUTH_TOKEN:-}" ]]; then
            echo "NPM_TOKEN is required only for the first publication" >&2
            exit 1
          fi
          npm publish "${{ steps.pack.outputs.filename }}" --access public --provenance
      - name: Publish subsequent versions with npm trusted publishing
        if: steps.registry.outputs.version_exists == 'false' && steps.registry.outputs.package_exists == 'true'
        run: npm publish "${{ steps.pack.outputs.filename }}" --access public
      - name: Wait for registry propagation
        shell: bash
        run: |
          set -euo pipefail
          name="@devcodex/capability-graph"
          package="${name}@${PACKAGE_VERSION}"
          for attempt in {1..30}; do
            cache="$RUNNER_TEMP/npm-registry-probe-$attempt"
            version="$(npm view "$package" version --prefer-online --cache "$cache" 2>/dev/null || true)"
            shasum="$(npm view "$package" dist.shasum --prefer-online --cache "$cache" 2>/dev/null || true)"
            latest="$(npm view "$name" dist-tags.latest --prefer-online --cache "$cache" 2>/dev/null || true)"
            echo "registry probe $attempt: version=${version:-<missing>} shasum=${shasum:-<missing>} latest=${latest:-<missing>}"
            if [[ "$version" == "$PACKAGE_VERSION" && "$shasum" == "${{ steps.pack.outputs.shasum }}" && "$latest" == "$PACKAGE_VERSION" ]]; then
              break
            fi
            if [[ "$attempt" == 30 ]]; then
              echo "$package did not propagate with the expected tarball and latest tag" >&2
              exit 1
            fi
            sleep 10
          done
      - name: Install the documented default and run the complete tutorial
        shell: bash
        run: |
          set -euo pipefail
          temporary="$(mktemp -d)"
          trap 'rm -rf "$temporary"' EXIT
          cd "$temporary"
          npm init -y >/dev/null
          npm install --ignore-scripts --no-audit --no-fund "@devcodex/capability-graph"
          node "$GITHUB_WORKSPACE/website/scripts/check-installed-tutorial.mjs" "$temporary" "$PACKAGE_VERSION"

  pages-build:
    needs: [freeze, package]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pages: write
      id-token: write
    env:
      PACKAGE_VERSION: ${{ needs.freeze.outputs.package_version }}
      RELEASE_ID: ${{ needs.freeze.outputs.release_id }}
      RELEASE_TAG: ${{ needs.freeze.outputs.release_tag }}
      RELEASE_COMMIT: ${{ needs.freeze.outputs.release_commit }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && github.sha || github.ref }}
          persist-credentials: false
      - uses: actions/setup-node@v7
        with:
          node-version: "22.12.0"
          cache: npm
          cache-dependency-path: |
            package-lock.json
            website/package-lock.json
      - run: npm ci
      - run: npm run build
      - run: npm ci
        working-directory: website
      - name: Refuse a stale documentation release
        shell: bash
        run: |
          set -euo pipefail
          latest="$(npm view @devcodex/capability-graph dist-tags.latest)"
          [[ "$latest" == "$PACKAGE_VERSION" ]] || {
            echo "npm latest is $latest, not $PACKAGE_VERSION" >&2
            exit 1
          }
      - run: npm run build:ai
        working-directory: website
      - uses: actions/configure-pages@v5
      - uses: actions/upload-pages-artifact@v4
        with:
          path: website/doc_build

  deploy:
    needs: [freeze, pages-build]
    runs-on: ubuntu-latest
    permissions:
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - uses: actions/setup-node@v7
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"
      - name: Refuse a stale Pages deployment
        shell: bash
        env:
          PACKAGE_VERSION: ${{ needs.freeze.outputs.package_version }}
        run: |
          set -euo pipefail
          latest="$(npm view @devcodex/capability-graph dist-tags.latest)"
          [[ "$latest" == "$PACKAGE_VERSION" ]] || {
            echo "npm latest is $latest, not $PACKAGE_VERSION" >&2
            exit 1
          }
      - id: deployment
        uses: actions/deploy-pages@v4

  public-verification:
    needs: [freeze, deploy]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && github.sha || github.ref }}
          persist-credentials: false
      - uses: actions/setup-node@v7
        with:
          node-version: "22.12.0"
      - run: node website/scripts/verify-public.mjs
        env:
          PACKAGE_VERSION: ${{ needs.freeze.outputs.package_version }}
          RELEASE_ID: ${{ needs.freeze.outputs.release_id }}
          RELEASE_TAG: ${{ needs.freeze.outputs.release_tag }}
          RELEASE_COMMIT: ${{ needs.freeze.outputs.release_commit }}