release.yml

name: Release & Version Roll

concurrency:
  group: release-polyxml
  cancel-in-progress: false

on:
  workflow_run:
    workflows: ["CI"]
    branches: [main]
    types:
      - completed
  workflow_dispatch:

jobs:
  release:
    name: Semantic Release & Version Roll
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
      actions: write
      issues: write
      pull-requests: write
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Setup Python
        uses: actions/setup-python@v7
        with:
          python-version: "3.12"

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: "20"

      - name: Run Semantic Release
        id: semantic
        uses: cycjimmy/semantic-release-action@v6
        with:
          extra_plugins: |
            @semantic-release/changelog
            @semantic-release/git
            @semantic-release/exec
        env:
          GITHUB_TOKEN: ${{ secrets.PAT_TOKEN || secrets.GITHUB_TOKEN }}

      - name: Tag Go module release
        if: steps.semantic.outputs.new_release_published == 'true'
        env:
          GH_TOKEN: ${{ secrets.PAT_TOKEN || secrets.GITHUB_TOKEN }}
          RELEASE_VERSION: ${{ steps.semantic.outputs.new_release_version }}
        run: |
          tag="bindings/go/v${RELEASE_VERSION}"
          git fetch origin "refs/tags/v${RELEASE_VERSION}:refs/tags/v${RELEASE_VERSION}"
          sha=$(git rev-parse "v${RELEASE_VERSION}^{commit}")
          if gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${tag}" >/dev/null 2>&1; then
            echo "Go module tag ${tag} already exists"
          else
            gh api --method POST "repos/${GITHUB_REPOSITORY}/git/refs" \
              -f "ref=refs/tags/${tag}" -f "sha=${sha}"
          fi

      - name: Dispatch Downstream Package Releases
        if: steps.semantic.outputs.new_release_published == 'true'
        env:
          GH_TOKEN: ${{ secrets.PAT_TOKEN || secrets.GITHUB_TOKEN }}
          HAS_PAT: ${{ secrets.PAT_TOKEN != '' }}
        run: |
          if [ "$HAS_PAT" = "true" ]; then
            echo "Release was published with PAT_TOKEN; downstream 'on: release' workflows are automatically triggered by GitHub. Skipping manual dispatch to prevent duplicate builds."
            exit 0
          fi
          NEW_TAG="v${{ steps.semantic.outputs.new_release_version }}"
          echo "Dispatched releases for $NEW_TAG (fallback when running without PAT)"
          for wf in release-crates.yml release-binaries.yml release-pypi.yml release-npm.yml release-maven.yml; do
            echo "Dispatching $wf..."
            gh workflow run "$wf" --ref "$NEW_TAG" || echo "Note: $wf dispatch skipped or handled by release event"
          done
          echo "Dispatching release-homebrew.yml with tag input..."
          gh workflow run release-homebrew.yml --ref main -f tag="$NEW_TAG" || echo "Note: release-homebrew.yml dispatch skipped or handled by release event"