release.yml

---
# yamllint disable rule:line-length
name: "Release"

'on':
  push:
    tags:
      - '[0-9]+.[0-9]+.[0-9]+'
  # Allow manual trigger for testing (will do a dry-run)
  workflow_dispatch:
    inputs:
      dry_run:
        description: 'Perform dry-run (do not create release)'
        required: false
        default: 'true'
        type: choice
        options:
          - 'true'
          - 'false'

# Prevent concurrent releases
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false  # Don't cancel in-progress releases

jobs:
  release:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0  # Need full history for release notes

      - uses: actions/setup-node@v6
        with:
          node-version: 26.x
          cache: 'npm'

      - name: Security Audit
        run: npm audit --audit-level=moderate

      - name: Install Dependencies and Build
        run: |
          npm ci --prefer-offline
          npm run deploy

      - name: Generate SBOM
        run: npm sbom --sbom-format=cyclonedx --omit=dev > sbom.json

      - name: Verify Tag Matches Package Version
        run: |
          PKG_VERSION=$(node -p "require('./package.json').version")

          # For tag pushes, verify tag matches package.json
          if [ "${{ github.event_name }}" = "push" ]; then
            TAG_VERSION="${GITHUB_REF#refs/tags/}"
            if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
              echo "Error: Git tag ($TAG_VERSION) does not match package.json version ($PKG_VERSION)"
              exit 1
            fi
            echo "Version verified: $TAG_VERSION"
          else
            # For manual triggers, verify the tag exists
            if ! git rev-parse "$PKG_VERSION" >/dev/null 2>&1; then
              echo "Error: Tag $PKG_VERSION does not exist. Available tags:"
              git tag -l | tail -5
              exit 1
            fi
            echo "Using package.json version: $PKG_VERSION"
          fi

      - name: Create Release Archive
        run: |
          # Determine version to use
          if [ "${{ github.event_name }}" = "push" ]; then
            VERSION="${GITHUB_REF#refs/tags/}"
          else
            VERSION=$(node -p "require('./package.json').version")
          fi

          mkdir -p release-artifacts
          tar -czf "release-artifacts/openinlets-$VERSION.tar.gz" \
            dist/*.bookmarklet \
            README.md \
            LICENSE \
            SECURITY.md \
            package.json

          # Copy individual bookmarklets
          cp dist/*.bookmarklet release-artifacts/

          # Save version for next steps
          echo "RELEASE_VERSION=$VERSION" >> "$GITHUB_ENV"

      - name: Generate Release Notes
        id: release_notes
        run: |
          # Determine version to use
          if [ "${{ github.event_name }}" = "push" ]; then
            TAG_VERSION="${GITHUB_REF#refs/tags/}"
          else
            TAG_VERSION=$(node -p "require('./package.json').version")
          fi

          PREV_TAG=$(git describe --abbrev=0 --tags "${TAG_VERSION}^" 2>/dev/null || echo "")

          {
            if [ -n "$PREV_TAG" ]; then
              echo "## What's Changed"
              echo ""
              git log --pretty=format:"- %s (%h)" "$PREV_TAG..HEAD"
            else
              echo "## Release $TAG_VERSION"
              echo ""
              echo "Initial release"
            fi

            echo ""
            echo "## Verification"
            echo ""
            echo "This release includes:"
            echo "- Signed commits and tags (verify with \`git verify-tag $TAG_VERSION\`)"
            echo "- Software Bill of Materials (SBOM) in CycloneDX format"
            echo "- Security audit results from CI pipeline"
            echo ""
            echo "See [SECURITY.md](SECURITY.md) for verification procedures."
          } > release-notes.md

      - name: Create GitHub Release (dry-run)
        if: github.event_name == 'workflow_dispatch' && inputs.dry_run == 'true'
        run: |
          echo "🧪 Dry-run mode - not actually creating release"
          echo "Would create release: OpenInlets ${{ env.RELEASE_VERSION }}"
          echo ""
          echo "Release notes preview:"
          cat release-notes.md
          echo ""
          echo "Release assets that would be uploaded:"
          ls -lh release-artifacts/*.tar.gz sbom.json
          echo ""
          echo "✓ Dry-run successful - release would be created"

      - name: Create GitHub Release
        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.dry_run == 'false')
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create ${{ env.RELEASE_VERSION }} \
            --title "OpenInlets ${{ env.RELEASE_VERSION }}" \
            --notes-file release-notes.md \
            --verify-tag \
            release-artifacts/*.tar.gz \
            sbom.json

      - name: Upload Release Artifacts
        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.dry_run == 'false')
        uses: actions/upload-artifact@v7
        with:
          name: release-${{ env.RELEASE_VERSION }}
          path: |
            release-artifacts/
            sbom.json
          retention-days: 90

  deploy-gh-pages:
    permissions:
      contents: write
    runs-on: ubuntu-latest
    needs: release
    timeout-minutes: 8
    # Only deploy gh-pages on actual releases, not dry-runs
    if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.dry_run == 'false')

    steps:
      - name: Checkout Tag
        uses: actions/checkout@v6
        with:
          ref: ${{ github.ref }}
          path: release-source

      - uses: actions/setup-node@v6
        with:
          node-version: 26.x
          cache: 'npm'
          cache-dependency-path: release-source/package-lock.json

      - name: Determine Release Version
        run: |
          cd release-source
          if [ "${{ github.event_name }}" = "push" ]; then
            VERSION="${GITHUB_REF#refs/tags/}"
          else
            VERSION=$(node -p "require('./package.json').version")
          fi
          echo "RELEASE_VERSION=$VERSION" >> "$GITHUB_ENV"

      - name: Build README.md
        run: |
          cd release-source
          npm ci --prefer-offline
          npm run deploy

      - name: Verify README.md Exists and is Valid
        run: |
          if [ ! -f release-source/README.md ]; then
            echo "Error: README.md not found in release"
            exit 1
          fi

          FILE_SIZE=$(stat -c%s release-source/README.md 2>/dev/null || stat -f%z release-source/README.md)
          if [ "$FILE_SIZE" -lt 100 ]; then
            echo "Error: README.md is too small (possible corruption)"
            exit 1
          fi

          echo "README.md verified: $FILE_SIZE bytes"

      - name: Checkout gh-pages Branch
        uses: actions/checkout@v6
        with:
          ref: gh-pages
          path: gh-pages-branch
          fetch-depth: 0

      - name: Update index.md in gh-pages
        run: |
          cd gh-pages-branch

          # Verify we're on gh-pages branch
          CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD)
          if [ "$CURRENT_BRANCH" != "gh-pages" ]; then
            echo "Error: Not on gh-pages branch (on $CURRENT_BRANCH)"
            exit 1
          fi

          # Copy README.md to index.md
          cp ../release-source/README.md index.md

          # Verify the copy succeeded and has content
          if [ ! -f index.md ] || [ ! -s index.md ]; then
            echo "Error: index.md copy failed or is empty"
            exit 1
          fi

          # Check if there are changes
          if git diff --quiet index.md; then
            echo "No changes to index.md, skipping commit"
            exit 0
          fi

          # Configure git (using GitHub Actions bot)
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          # Commit and push
          git add index.md
          git commit -m "chore(docs): update index.md for release ${{ env.RELEASE_VERSION }}

          Auto-updated from README.md via release workflow
          Source: ${{ github.sha }}

          🤖 Generated with GitHub Actions"

          # Verify commit was created
          if ! git log -1 --pretty=format:"%s" | grep -q "update index.md"; then
            echo "Error: Commit was not created properly"
            exit 1
          fi

          git push origin gh-pages

          echo "✓ Successfully updated gh-pages index.md for release ${{ env.RELEASE_VERSION }}"