cd.yml

name: cd.yml

on:
  push:
    branches:
      - develop
      - master
      - main
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: cd-${{ github.ref_name }}
  cancel-in-progress: ${{ github.ref_name == 'develop' }}

jobs:
  guard-manual-stable:
    if: github.event_name == 'workflow_dispatch' && (github.ref_name == 'main' || github.ref_name == 'master')
    runs-on: ubuntu-latest
    steps:
      - name: Stop manual stable runs here
        run: |
          echo "Use .github/workflows/release.yml for manual stable releases."
          exit 1

  prepare-prerelease:
    if: |
      (github.event_name == 'push' && github.ref_name == 'develop') ||
      (github.event_name == 'workflow_dispatch' && github.ref_name != 'main' && github.ref_name != 'master')
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.version.outputs.tag }}
    steps:
      - name: Check out code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          fetch-depth: 0

      - name: Compute prerelease tag
        id: version
        shell: bash
        run: |
          set -euo pipefail

          manifest_version="$(sed -n 's/.*\"\.\" *: *\"\([0-9][0-9.]*\)\".*/\1/p' .release-please-manifest.json)"
          bootstrap_sha="$(sed -n 's/.*\"bootstrap-sha\" *: *\"\([0-9a-f]\{40\}\)\".*/\1/p' .github/release-please-config.json)"
          latest_tag="$(
            {
              git tag --list 'v[0-9]*.[0-9]*.[0-9]*' --sort=-version:refname
              git tag --list 'codeguard-v[0-9]*.[0-9]*.[0-9]*' --sort=-version:refname
            } | head -n 1
          )"

          if [ -n "$latest_tag" ]; then
            if [[ "$latest_tag" == codeguard-v* ]]; then
              base_version="${latest_tag#codeguard-v}"
            else
              base_version="${latest_tag#v}"
            fi
            commit_range="${latest_tag}..HEAD"
          else
            base_version="${manifest_version:-0.1.0}"
            if [ -n "$bootstrap_sha" ]; then
              commit_range="${bootstrap_sha}..HEAD"
            else
              commit_range="HEAD"
            fi
          fi

          subjects="$(git log --format='%s' "$commit_range" 2>/dev/null || true)"
          bodies="$(git log --format='%b' "$commit_range" 2>/dev/null || true)"

          bump="patch"
          if printf '%s\n%s\n' "$subjects" "$bodies" | grep -Eq 'BREAKING CHANGE|^[^[:space:]]+(\([^)]+\))?!:'; then
            bump="major"
          elif printf '%s\n' "$subjects" | grep -Eq '^feat(\([^)]+\))?:'; then
            bump="minor"
          fi

          IFS=. read -r major minor patch <<<"$base_version"

          case "$bump" in
            major)
              major=$((major + 1))
              minor=0
              patch=0
              ;;
            minor)
              minor=$((minor + 1))
              patch=0
              ;;
            patch)
              patch=$((patch + 1))
              ;;
          esac

          next_version="${major}.${minor}.${patch}"
          tag="v${next_version}-rc.${GITHUB_RUN_NUMBER}"

          echo "tag=$tag" >>"$GITHUB_OUTPUT"
          echo "Using prerelease tag $tag"

  prerelease:
    needs: prepare-prerelease
    if: needs.prepare-prerelease.result == 'success'
    uses: ./.github/workflows/release.yml
    permissions:
      actions: read
      contents: write
      id-token: write
      packages: write
    with:
      tag: ${{ needs.prepare-prerelease.outputs.tag }}
      prerelease: true
      create_missing_tag: true
    secrets:
      RELEASE_PLEASE_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}

  release-please:
    if: github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'master')
    runs-on: ubuntu-latest
    permissions:
      contents: write
      issues: write
      pull-requests: write
    outputs:
      release_created: ${{ steps.release.outputs.release_created }}
      tag_name: ${{ steps.release.outputs.tag_name }}
    steps:
      - name: Require release bot token
        shell: bash
        env:
          RELEASE_PLEASE_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
        run: |
          set -euo pipefail

          if [ -z "$RELEASE_PLEASE_TOKEN" ]; then
            echo "RELEASE_PLEASE_TOKEN is required."
            echo "Use a PAT or GitHub App token for the release bot so release PRs trigger required pull_request workflows."
            exit 1
          fi

      - name: Run release-please
        id: release
        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5
        with:
          token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
          config-file: .github/release-please-config.json
          manifest-file: .release-please-manifest.json

  stable-release:
    needs: release-please
    if: needs.release-please.outputs.release_created == 'true'
    uses: ./.github/workflows/release.yml
    permissions:
      actions: read
      contents: write
      id-token: write
      packages: write
    with:
      tag: ${{ needs.release-please.outputs.tag_name }}
      prerelease: false
      create_missing_tag: true
    secrets:
      RELEASE_PLEASE_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}

  # npm/PyPI publishing lives here in cd.yml (the top-level entry workflow), NOT
  # in the reusable release.yml. Running here means the OIDC workflow_ref and
  # job_workflow_ref claims both resolve to cd.yml, so a single trusted publisher
  # (cd.yml) satisfies both auth and PEP 740 attestation verification. Publishing
  # from the reusable release.yml splits those claims (workflow_ref=cd.yml,
  # job_workflow_ref=release.yml) and PyPI rejects the attestation. Both jobs run
  # only after a stable release-please release, and pull the built binaries from
  # the GitHub release that stable-release just created.
  publish-npm:
    needs: [release-please, stable-release]
    if: needs.release-please.outputs.release_created == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write # npm trusted publishing (OIDC) — no NPM_TOKEN needed.
    steps:
      - name: Check out code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "22"

      - name: Upgrade npm for trusted publishing
        # Trusted publishing (OIDC) requires npm >= 11.5.1; the runner ships an
        # older npm by default.
        run: npm install -g npm@latest

      - name: Resolve package version
        id: version
        shell: bash
        env:
          RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
        run: |
          set -euo pipefail
          if [[ "$RELEASE_TAG" == *-v* ]]; then
            version="${RELEASE_TAG##*-v}"
          else
            version="${RELEASE_TAG#v}"
          fi
          echo "version=$version" >>"$GITHUB_OUTPUT"

      - name: Stage release binaries
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          ./packaging/extract-binaries.sh "${{ needs.release-please.outputs.tag_name }}" "${{ steps.version.outputs.version }}"

      - name: Build npm packages
        run: ./packaging/npm/build.sh "${{ steps.version.outputs.version }}"

      - name: Publish to npm
        # Authentication is via OIDC trusted publishing (id-token: write above);
        # no NODE_AUTH_TOKEN/.npmrc. Provenance is attached automatically.
        shell: bash
        run: |
          set -euo pipefail

          publish_dir() {
            local dir="$1"
            local name ver
            name="$(node -p "require('./$dir/package.json').name")"
            ver="$(node -p "require('./$dir/package.json').version")"
            if npm view "$name@$ver" version >/dev/null 2>&1; then
              echo "$name@$ver already published, skipping"
            else
              npm publish "$dir" --access public
            fi
          }

          # Platform packages first so the launcher's optional deps resolve.
          for dir in packaging/npm/dist/codeguard-*/package; do
            publish_dir "$dir"
          done
          publish_dir packaging/npm/dist/codeguard/package

  publish-pypi:
    needs: [release-please, stable-release]
    if: needs.release-please.outputs.release_created == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write # PyPI trusted publishing (OIDC) — no PYPI_API_TOKEN needed.
    steps:
      - name: Check out code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.12"

      - name: Resolve package version
        id: version
        shell: bash
        env:
          RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
        run: |
          set -euo pipefail
          if [[ "$RELEASE_TAG" == *-v* ]]; then
            version="${RELEASE_TAG##*-v}"
          else
            version="${RELEASE_TAG#v}"
          fi
          echo "version=$version" >>"$GITHUB_OUTPUT"

      - name: Stage release binaries
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          ./packaging/extract-binaries.sh "${{ needs.release-please.outputs.tag_name }}" "${{ steps.version.outputs.version }}"

      - name: Build wheels
        run: |
          set -euo pipefail
          python3 packaging/pypi/build_wheels.py "${{ steps.version.outputs.version }}" packaging/.staging packaging/pypi/dist

      - name: Publish to PyPI
        # Attestations stay on (the default): running in cd.yml makes both OIDC
        # claims resolve to cd.yml, so the PEP 740 attestation matches the cd.yml
        # trusted publisher.
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1
        with:
          packages-dir: packaging/pypi/dist
          skip-existing: true