release-alpha.yml

name: 🚀 Release Alpha

on:
  push:
    branches: [dev]
  workflow_dispatch:
    inputs:
      publish_only:
        description: "Publish existing alpha versions without versioning, changelog, or git changes"
        required: true
        type: boolean
        default: false
      projects:
        description: "Comma-separated existing Nx release project names; required for publish-only recovery"
        required: false
        type: string

concurrency:
  group: release-alpha
  cancel-in-progress: false

env:
  DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/effectify"

jobs:
  release-alpha:
    name: 🚀 Release Alpha
    runs-on: ubuntu-latest
    permissions:
      contents: write # Needed for git operations
      id-token: write # Needed for npm provenance
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: effectify
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - name: 📥 Checkout
        uses: actions/checkout@v5
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: 📦 Install pnpm
        uses: pnpm/action-setup@v6
        with:
          version: 10.14.0

      - name: 🏗️ Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: "24.19.0"
          cache: "pnpm"
          registry-url: "https://registry.npmjs.org/"

      - name: 📦 Install dependencies
        run: pnpm install --frozen-lockfile

      - name: 🛡️ Verify release policy contract
        run: node --test scripts/release-policy-contract.test.mjs

      - name: 🔧 Configure Git
        if: ${{ inputs.publish_only != true }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: 🔍 Detect Affected Release Projects
        id: affected
        env:
          PUBLISH_ONLY: ${{ inputs.publish_only || false }}
          RECOVERY_PROJECTS: ${{ inputs.projects || '' }}
          BEFORE_SHA: ${{ github.event.before }}
          HEAD_SHA: ${{ github.sha }}
        run: |
          RELEASE_PROJECTS=$(
            jq -r '.release.projects[]' nx.json | while read -r path; do
              pnpm nx show project "$path" --json | jq -r '.name'
            done | jq -Rsc 'split("\n") | map(select(length > 0)) | unique'
          )

          if [ "$PUBLISH_ONLY" = "true" ]; then
            if [ -z "$RECOVERY_PROJECTS" ]; then
              echo "publish-only recovery requires an explicit comma-separated projects input" >&2
              exit 1
            fi
            SELECTED_PROJECTS=$(printf '%s' "$RECOVERY_PROJECTS" | tr ',' '\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | sed '/^$/d' | sort -u)
            while IFS= read -r project; do
              if ! printf '%s\n' "$RELEASE_PROJECTS" | jq -r '.[]' | grep -Fx -- "$project" >/dev/null; then
                echo "Invalid release project: $project" >&2
                exit 1
              fi
            done <<< "$SELECTED_PROJECTS"
            AFFECTED_RELEASE_PROJECTS=$(printf '%s' "$SELECTED_PROJECTS" | paste -sd, -)
            echo "has_projects=true" >> "$GITHUB_OUTPUT"
            echo "projects=$AFFECTED_RELEASE_PROJECTS" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          ZERO_SHA="0000000000000000000000000000000000000000"
          BEFORE="$BEFORE_SHA"
          HEAD="$HEAD_SHA"
          if ! git cat-file -e "${HEAD}^{commit}" 2>/dev/null; then
            HEAD=$(git rev-parse HEAD)
          fi
          if [ -n "$BEFORE" ] && [ "$BEFORE" != "$ZERO_SHA" ] && git cat-file -e "${BEFORE}^{commit}" 2>/dev/null; then
            BASE="$BEFORE"
          elif git rev-parse --verify HEAD^ >/dev/null 2>&1; then
            BASE="HEAD^"
          else
            BASE="$HEAD"
          fi

          AFFECTED_RAW=$(pnpm nx show projects --affected --base="$BASE" --head="$HEAD" --json 2>/dev/null || echo "[]")
          AFFECTED_RELEASE_PROJECTS=$(echo "$AFFECTED_RAW" | jq -r --argjson release "$RELEASE_PROJECTS" '[.[] | select(. as $project | $release | index($project))] | unique | join(",")' 2>/dev/null || echo "")
          if [ -z "$AFFECTED_RELEASE_PROJECTS" ] || [ "$AFFECTED_RELEASE_PROJECTS" = "null" ]; then
            echo "has_projects=false" >> "$GITHUB_OUTPUT"
            echo "projects=" >> "$GITHUB_OUTPUT"
          else
            echo "has_projects=true" >> "$GITHUB_OUTPUT"
            echo "projects=$AFFECTED_RELEASE_PROJECTS" >> "$GITHUB_OUTPUT"
          fi

      - name: 🏗️ Build Affected Projects
        if: ${{ steps.affected.outputs.has_projects == 'true' }}
        env:
          PROJECTS: ${{ steps.affected.outputs.projects }}
        run: pnpm nx run-many -t build "--projects=$PROJECTS" --parallel=3

      - name: 🧪 Test Affected Projects
        if: ${{ steps.affected.outputs.has_projects == 'true' }}
        env:
          PROJECTS: ${{ steps.affected.outputs.projects }}
        run: pnpm nx run-many -t test "--projects=$PROJECTS" --parallel=3 --passWithNoTests

      - name: 🔐 Verify npm authentication
        if: ${{ steps.affected.outputs.has_projects == 'true' }}
        run: npm whoami
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: 🚀 Version, Changelog & Publish Alpha
        if: ${{ steps.affected.outputs.has_projects == 'true' }}
        env:
          PROJECTS: ${{ steps.affected.outputs.projects }}
          PUBLISH_ONLY: ${{ inputs.publish_only || false }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_CONFIG_PROVENANCE: true
        run: |
          if [ "$PUBLISH_ONLY" != "true" ]; then
            pnpm nx release "--projects=$PROJECTS" --preid=alpha --skip-publish
            pnpm nx run-many -t build "--projects=$PROJECTS" --parallel=3
          fi
          # Publish-only mode builds selected existing manifests and performs no git mutation.
          pnpm nx release publish "--projects=$PROJECTS" --tag=alpha

      - name: 📊 Release Summary
        if: always()
        env:
          HAS_PROJECTS: ${{ steps.affected.outputs.has_projects }}
          PROJECTS: ${{ steps.affected.outputs.projects }}
          PUBLISH_ONLY: ${{ inputs.publish_only || false }}
        run: |
          echo "## 🚀 Alpha Release Summary" >> "$GITHUB_STEP_SUMMARY"
          if [ "$HAS_PROJECTS" = "true" ]; then
            echo "**Projects:** $PROJECTS" >> "$GITHUB_STEP_SUMMARY"
            if [ "$PUBLISH_ONLY" = "true" ]; then
              echo "**Mode:** publish-only recovery; selected existing manifests were built and published with the alpha tag." >> "$GITHUB_STEP_SUMMARY"
            fi
          else
            echo "⏭️ **Skipped - No affected projects**" >> "$GITHUB_STEP_SUMMARY"
          fi