release.yml

# Release
#
# Publish GitHub releases after a release is merged.
#
# References:
#
# - https://cli.github.com/manual/gh_release_create
# - https://docs.github.com/actions/learn-github-actions/contexts
# - https://docs.github.com/actions/learn-github-actions/expressions
# - https://docs.github.com/actions/reference/workflows-and-actions/workflow-commands
# - https://docs.github.com/actions/using-workflows/events-that-trigger-workflows#push
# - https://docs.github.com/actions/using-workflows/using-github-cli-in-workflows
# - https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions
# - https://docs.github.com/webhooks-and-events/webhooks/webhook-events-and-payloads#push
# - https://git-scm.com/book/en/v2/Git-Basics-Tagging
# - https://github.com/actions/checkout
# - https://github.com/crazy-max/ghaction-import-gpg
# - https://github.com/flex-development/dist-tag-action
# - https://github.com/flex-development/gh-release-url-action
# - https://github.com/flex-development/grease
# - https://github.com/flex-development/jq-action
# - https://github.com/flex-development/manver-action
# - https://github.com/hmarr/debug-action
# - https://github.com/kaisugi/action-regex-match
# - https://regex101.com/r/wu576x
# - https://yarnpkg.com/cli/pack
# - https://yarnpkg.com/cli/workspace

---
name: release
on:
  push:
    branches:
      - main
env:
  CACHE_PATH_DEPS: |
    node_modules
    packages/*/node_modules
  CACHE_PATH_BUILD: packages/*/dist
jobs:
  preflight:
    if: ${{ startsWith(github.event.head_commit.message, 'release:') }}
    permissions:
      contents: read
    runs-on: ubuntu-latest
    outputs:
      cache-build: ${{ steps.cache-key-build.outputs.result }}
      cache-deps: ${{ steps.cache-key-deps.outputs.result }}
      pr: ${{ steps.metadata.outputs.group8 }}
      workspaces: ${{ steps.workspaces.outputs.result }}
    steps:
      - id: debug
        name: Print environment variables and event payload
        uses: hmarr/debug-action@v3.0.0
      - id: fail-actor
        if: contains(vars.MAINTAINERS, github.actor) == false
        name: Fail on unauthorized actor
        run: |
          echo '**Unauthorized actor: ${{ github.actor }}**' >>$GITHUB_STEP_SUMMARY
          exit 1
      - id: checkout
        name: Checkout ${{ github.ref_name }}
        uses: actions/checkout@v7.0.1
        with:
          ref: ${{ github.sha }}
      - id: metadata
        name: Extract release metadata
        uses: kaisugi/action-regex-match@v1.0.2
        with:
          flags: u
          regex: ${{ vars.RELEASE_MERGED_REGEX }}
          text: ${{ github.event.head_commit.message }}
      - id: fail-metadata
        if: steps.metadata.outputs.match == ''
        name: Fail on invalid head commit message
        run: |
          err='**Invalid release merge message**
          ```sh
          ${{ github.event.head_commit.message }}
          ```
          Message must match [`${{ vars.RELEASE_MERGED_REGEX }}`](https://regex101.com/r/wu576x)'
          echo "$err" >>$GITHUB_STEP_SUMMARY
          exit 1
      - id: dependencies
        name: Install dependencies
        run: yarn --immutable
      - id: build
        name: Build workspaces
        run: yarn build
      - id: cache-key-deps
        name: Get dependencies cache key
        run: echo "result=${{ hashFiles('yarn.lock') }}" >>$GITHUB_OUTPUT
      - id: cache-key-build
        name: Get build cache key
        run: echo "result=${{ hashFiles(env.CACHE_PATH_BUILD) }}" >>$GITHUB_OUTPUT
      - id: cache-deps
        name: Cache dependencies
        uses: actions/cache@v6.1.0
        with:
          key: ${{ steps.cache-key-deps.outputs.result }}
          path: ${{ env.CACHE_PATH_DEPS }}
      - id: cache-build
        name: Cache build
        uses: actions/cache@v6.1.0
        with:
          key: ${{ steps.cache-key-build.outputs.result }}
          path: ${{ env.CACHE_PATH_BUILD }}
      - id: workspaces
        name: Get workspace matrix
        uses: flex-development/jq-action@1.0.0
        with:
          data: ./versions/${{ steps.metadata.outputs.group2 }}.json
          filter: keys
  publish:
    needs: preflight
    runs-on: ubuntu-latest
    environment:
      name: release
      url: ${{ steps.environment.outputs.url }}
    strategy:
      matrix:
        workspace: ${{ fromJson(needs.preflight.outputs.workspaces) }}
    env:
      GITHUB_TOKEN: ${{ secrets.GH_REPO_TOKEN }}
      HUSKY: 0
      NOTES_FILE: RELEASE_NOTES.md
    steps:
      - id: checkout
        name: Checkout ${{ github.ref_name }}
        uses: actions/checkout@v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: true
          ref: ${{ github.sha }}
          token: ${{ env.GITHUB_TOKEN }}
      - id: gpg-import
        name: Import GPG key
        uses: crazy-max/ghaction-import-gpg@v7.0.0
        with:
          git_config_global: true
          git_push_gpgsign: false
          git_tag_gpgsign: true
          git_user_signingkey: true
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PASSPHRASE }}
          trust_level: 5
      - id: node
        name: Setup Node.js
        uses: actions/setup-node@v7.0.0
        with:
          cache: yarn
          cache-dependency-path: yarn.lock
          node-version-file: .nvmrc
      - id: restore-dep-cache
        name: Restore dependencies cache
        uses: actions/cache@v6.1.0
        with:
          fail-on-cache-miss: true
          key: ${{ needs.preflight.outputs.cache-deps }}
          path: ${{ env.CACHE_PATH_DEPS }}
      - id: restore-build-cache
        name: Restore build cache
        uses: actions/cache@v6.1.0
        with:
          fail-on-cache-miss: true
          key: ${{ needs.preflight.outputs.cache-build }}
          path: ${{ env.CACHE_PATH_BUILD }}
      - id: local-binaries
        name: Add local binaries to path
        run: echo "${{ github.workspace }}/node_modules/.bin" >> ${{ github.path }}
      - id: package
        name: Get unscoped package name
        run: |
          workspace=${{ matrix.workspace }}
          echo "result=${workspace#@*/}" >>$GITHUB_OUTPUT
      - id: workspace-directory
        if: matrix.workspace != steps.package.outputs.result
        name: Get workspace directory
        run: echo "result=$(yarn workspace ${{ matrix.workspace }} exec pwd)" >>$GITHUB_OUTPUT
      - id: version
        name: Get release version
        uses: flex-development/jq-action@1.0.0
        with:
          data: ${{ steps.workspace-directory.outputs.result || github.workspace }}/package.json
          filter: .version
      - id: dist
        if: matrix.workspace != steps.package.outputs.result
        name: Get dist tag
        uses: flex-development/dist-tag-action@1.1.2
        with:
          target: ${{ steps.version.outputs.result }}
      - id: environment
        name: Get release url
        uses: flex-development/gh-release-url-action@2.1.0
        with:
          tag-prefix: ${{ matrix.workspace != steps.package.outputs.result && format('{0}@', steps.package.outputs.result) || '' }}
          version: ${{ steps.version.outputs.result }}
      - id: dev-deps
        if: matrix.workspace != steps.package.outputs.result
        name: Remove `devDependencies` from manifest
        run: yq 'del(.devDependencies)' -i package.json
        working-directory: ${{ steps.workspace-directory.outputs.result }}
      - id: build-metadata
        if: matrix.workspace != steps.package.outputs.result
        name: Add build metadata to manifest
        run: yq '.build="${{ github.sha }}"' -i package.json
        working-directory: ${{ steps.workspace-directory.outputs.result }}
      - id: pack
        if: matrix.workspace != steps.package.outputs.result
        name: Pack project
        run: |
          mv CHANGELOG.md _CHANGELOG.md
          yarn pack --out %s-%v.tgz
          mv _CHANGELOG.md CHANGELOG.md
        working-directory: ${{ steps.workspace-directory.outputs.result }}
      - id: notes
        if: matrix.workspace != steps.package.outputs.result
        name: Generate release notes
        env:
          TZ: ${{ vars.TZ }}
        run: |
          grease changelog -wo $NOTES_FILE
          echo "$(cat $NOTES_FILE)" >>$GITHUB_STEP_SUMMARY
        working-directory: ${{ steps.workspace-directory.outputs.result }}
      - id: tag
        name: Create annotated tag
        run: 'grease tag -ps -m="release: {tag}" ${{ steps.version.outputs.result }}'
        working-directory: ${{ steps.workspace-directory.outputs.result }}
      - id: publish
        if: matrix.workspace != steps.package.outputs.result
        name: Publish release
        run: |
          gh release create ${{ steps.environment.outputs.tag }} *.tgz --title=${{ steps.environment.outputs.tag }} --notes-file=${{ env.NOTES_FILE }} --prerelease=${{ steps.dist.outputs.prerelease }} --verify-tag --discussion-category=releases
        working-directory: ${{ steps.workspace-directory.outputs.result }}