release.yml

name: Release

# One `v*` tag ships the whole release: the extension .vsix onto a GitHub release AND
# the npm package (@pounceai/bob-control) — same trigger, so the two can't drift apart.
# Manual runs are dry runs: they upload the .vsix artifact and `npm publish --dry-run`,
# touching neither the release nor the registry.
on:
  push:
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: write # create the release / upload the .vsix asset

# Serialize runs for the same ref so a re-run can't race another in-flight run into a
# double `gh release create`. Not cancel-in-progress: never interrupt a publish midway.
concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  package-extension:
    # Packaging is pure Node (vsce), so the cheaper ubuntu runner is fine here — unlike
    # CI, which runs on Windows because the worker drives Bob over Windows named pipes.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-node@v5
        with:
          node-version: "22.x"
          cache: npm
          cache-dependency-path: extension/package-lock.json

      - name: Verify tag matches manifest version
        if: startsWith(github.ref, 'refs/tags/')
        working-directory: extension
        # vsce stamps the VSIX from package.json `version`, but the release is named from the
        # tag. Fail loudly on drift instead of attaching a mislabeled artifact to the release.
        run: |
          pkg="v$(node -p "require('./package.json').version")"
          if [ "$GITHUB_REF_NAME" != "$pkg" ]; then
            echo "::error::Tag $GITHUB_REF_NAME does not match extension/package.json version $pkg — bump the manifest or retag."
            exit 1
          fi

      - name: Install extension deps
        working-directory: extension
        run: npm ci

      - name: Package VSIX
        working-directory: extension
        # `npm run package` runs `vscode:prepublish` (tsc) first, so out/*.js is fresh.
        run: npm run package

      - name: Upload VSIX artifact
        # Only useful for manual dry runs; tagged runs persist the .vsix as a permanent
        # release asset below, so don't also double-store it as a 90-day Actions artifact.
        if: github.event_name == 'workflow_dispatch'
        uses: actions/upload-artifact@v4
        with:
          name: bob-tasks-vsix
          path: extension/*.vsix
          if-no-files-found: error

      - name: Publish the release
        if: startsWith(github.ref, 'refs/tags/')
        env:
          GH_TOKEN: ${{ github.token }}
        # Probe for an existing release first so a genuine `create` failure (auth, network)
        # surfaces, rather than masking it behind an `|| upload` fallback.
        run: |
          if gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1; then
            gh release upload "$GITHUB_REF_NAME" extension/*.vsix --clobber
          else
            gh release create "$GITHUB_REF_NAME" extension/*.vsix \
              --title "$GITHUB_REF_NAME" --generate-notes
          fi

  publish-npm:
    # Publishing is registry I/O; `prepublishOnly` (build + shebang gate) supplies the
    # artifacts, so the cheap ubuntu runner is fine here too. Independent of
    # package-extension: a VSIX hiccup must not strand the npm side, and vice versa.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-node@v5
        with:
          node-version: "22.x"
          cache: npm
          # Writes the .npmrc that reads NODE_AUTH_TOKEN — publish fails auth without it.
          registry-url: "https://registry.npmjs.org"

      - name: Verify tag matches package version
        if: startsWith(github.ref, 'refs/tags/')
        # Same drift gate as the extension job, for the ROOT manifest npm stamps.
        run: |
          pkg="v$(node -p "require('./package.json').version")"
          if [ "$GITHUB_REF_NAME" != "$pkg" ]; then
            echo "::error::Tag $GITHUB_REF_NAME does not match package.json version $pkg — bump the manifest or retag."
            exit 1
          fi

      - name: Install deps
        run: npm ci

      - name: Publish to npm
        if: startsWith(github.ref, 'refs/tags/')
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        # A version already on the registry means a re-run after a successful publish —
        # skip idempotently (npm versions are immutable; republish would only error).
        # A missing token fails HERE with the fix, not as an opaque 401 from npm.
        run: |
          ver="$(node -p "require('./package.json').version")"
          if [ -n "$(npm view "@pounceai/bob-control@$ver" version 2>/dev/null)" ]; then
            echo "@pounceai/bob-control@$ver is already on the registry — skipping."
            exit 0
          fi
          if [ -z "$NODE_AUTH_TOKEN" ]; then
            echo "::error::NPM_TOKEN secret is not set — add an npm automation token in repo Settings → Secrets and re-run."
            exit 1
          fi
          npm publish

      - name: Dry-run publish (manual run)
        if: github.event_name == 'workflow_dispatch'
        # Exercises prepublishOnly + the files allowlist against the registry, writes nothing.
        run: npm publish --dry-run