publish-cli.yaml

name: Publish CLI

on:
  push:
    branches:
      - main
    paths:
      - "cli/**"
    tags:
      - "cli-v*"
  workflow_dispatch:
    inputs:
      tag:
        description: "npm dist-tag (e.g. latest, next)"
        required: false
        default: "latest"

concurrency:
  group: publish-cli-${{ github.ref }}
  cancel-in-progress: false

jobs:
  publish:
    name: Publish @cleanslice/ranch to npm
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - uses: actions/setup-node@v4
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org
          always-auth: true

      - name: Resolve versions
        id: versions
        working-directory: cli
        run: |
          PKG_VERSION=$(node -p "require('./package.json').version")
          PUBLISHED=$(npm view @cleanslice/ranch version 2>/dev/null || echo "")
          echo "package=$PKG_VERSION" >> "$GITHUB_OUTPUT"
          echo "published=$PUBLISHED" >> "$GITHUB_OUTPUT"
          echo "Package version:   $PKG_VERSION"
          echo "Published version: ${PUBLISHED:-<none>}"

      - name: Verify tag matches package version
        if: startsWith(github.ref, 'refs/tags/cli-v')
        working-directory: cli
        run: |
          TAG_VERSION="${GITHUB_REF_NAME#cli-v}"
          if [ "$TAG_VERSION" != "${{ steps.versions.outputs.package }}" ]; then
            echo "::error::Tag $GITHUB_REF_NAME does not match cli/package.json version ${{ steps.versions.outputs.package }}"
            exit 1
          fi

      - name: Decide whether to publish
        id: gate
        run: |
          PKG="${{ steps.versions.outputs.package }}"
          PUB="${{ steps.versions.outputs.published }}"
          EVENT="${{ github.event_name }}"
          if [ "$EVENT" = "workflow_dispatch" ] || [ "${{ startsWith(github.ref, 'refs/tags/cli-v') }}" = "true" ]; then
            echo "publish=true" >> "$GITHUB_OUTPUT"
            echo "Publishing (manual or tag trigger)"
          elif [ "$PKG" = "$PUB" ]; then
            echo "publish=false" >> "$GITHUB_OUTPUT"
            echo "Version $PKG already published — skipping."
          else
            echo "publish=true" >> "$GITHUB_OUTPUT"
            echo "Version bumped: $PUB → $PKG — will publish."
          fi

      - name: Install dependencies
        if: steps.gate.outputs.publish == 'true'
        run: bun install --frozen-lockfile

      - name: Build
        if: steps.gate.outputs.publish == 'true'
        working-directory: cli
        run: bun run build

      - name: Pack (dry run, sanity check)
        if: steps.gate.outputs.publish == 'true'
        working-directory: cli
        run: npm pack --dry-run

      - name: Publish to npm
        if: steps.gate.outputs.publish == 'true'
        working-directory: cli
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          DIST_TAG="${{ github.event.inputs.tag || 'latest' }}"
          npm publish --tag "$DIST_TAG" --provenance --access public

      - name: Create git tag
        if: steps.gate.outputs.publish == 'true' && github.event_name == 'push' && github.ref == 'refs/heads/main'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="cli-v${{ steps.versions.outputs.package }}"
          if git rev-parse "$TAG" >/dev/null 2>&1; then
            echo "Tag $TAG already exists — skipping"
            exit 0
          fi
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git tag "$TAG"
          git push origin "$TAG"

      - name: Create GitHub Release
        if: steps.gate.outputs.publish == 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REPO: ${{ github.repository }}
        run: |
          VERSION="${{ steps.versions.outputs.package }}"
          TAG="cli-v$VERSION"
          DIST_TAG="${{ github.event.inputs.tag || 'latest' }}"

          if gh release view "$TAG" >/dev/null 2>&1; then
            echo "Release $TAG already exists — skipping"
            exit 0
          fi

          git fetch --tags --quiet
          PREV_TAG=$(git tag --list 'cli-v*' --sort=-v:refname \
            | grep -vx "$TAG" \
            | head -n1 || true)

          {
            echo "## What's Changed"
            echo ""
            if [ -n "$PREV_TAG" ]; then
              CHANGES=$(git log "${PREV_TAG}..${TAG}" \
                --pretty='format:- %s (%h)' --no-merges -- cli/ || true)
              if [ -z "$CHANGES" ]; then
                echo "_No CLI-scoped changes since $PREV_TAG._"
              else
                echo "$CHANGES"
              fi
              echo ""
              echo "**Full diff:** https://github.com/$REPO/compare/$PREV_TAG...$TAG"
            else
              echo "Initial release."
            fi
            echo ""
            echo "## Install / Upgrade"
            echo ""
            echo '```bash'
            echo "bun add -g @cleanslice/ranch@$VERSION"
            echo "# or"
            echo "npm install -g @cleanslice/ranch@$VERSION"
            echo "# or, if already installed:"
            echo "ranch upgrade"
            echo '```'
          } > /tmp/release-notes.md

          PRERELEASE_FLAG=""
          if [ "$DIST_TAG" != "latest" ]; then
            PRERELEASE_FLAG="--prerelease"
          fi

          # CLI releases never claim the "Latest" badge — that's reserved for
          # platform releases (v*). Pass --latest=false explicitly.
          gh release create "$TAG" \
            --title "Ranch CLI v$VERSION" \
            --notes-file /tmp/release-notes.md \
            --target "${{ github.sha }}" \
            --latest=false \
            $PRERELEASE_FLAG