release.yml

name: Release packages

on:
  push:
    branches:
      - main

# contents: write and pull-requests: write let changesets/action push the
# changeset-release/main branch and open/update the "Version Packages" PR.
# actions: write lets the built-in token dispatch CI for that generated branch
# when no external Changesets token is configured. workflow_dispatch is one of
# the explicit recursion exceptions for GITHUB_TOKEN-created events.
# The repository setting "Allow GitHub Actions to create and approve pull
# requests" must also be on, or the PR step fails after the branch is pushed.
permissions:
  actions: write
  contents: write
  pull-requests: write

concurrency:
  group: package-release

jobs:
  preview:
    name: Publish and verify pkg.pr.new
    permissions: {}
    uses: ./.github/workflows/package-preview.yml

  release:
    name: Version Packages / verify release
    needs: preview
    runs-on: ubuntu-latest
    timeout-minutes: 60
    env:
      # pkg.pr.new is the distribution channel. The reusable preview job
      # publishes and resolves all four commit-addressed package URLs before
      # this job maintains or verifies a Version Packages commit.
      CHANGESETS_TOKEN_CONFIGURED: ${{ secrets.CHANGESETS_GITHUB_TOKEN != '' }}
      AGENT_BUNDLE_PLAYWRIGHT_CHANNEL: chromium
      # Packed qualification writes package/digest evidence here when
      # `pnpm check:release` runs. `github.workspace` is valid at job env;
      # `runner.temp` is not (no runner assigned yet).
      AGENT_BUNDLE_RELEASE_EVIDENCE: ${{ github.workspace }}/.release-qualification.json
    steps:
      # The action pushes and opens the PR through the GitHub API with the
      # token passed below, so the checkout must not persist GITHUB_TOKEN.
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      # The release gates run the packed pool, whose packed-release.e2e is a
      # Workbench browser suite: same pinned Playwright Chromium as ci.yml and
      # nightly.yml (AGENT_BUNDLE_PLAYWRIGHT_CHANNEL below), so the tree that
      # ships is proven on the build the nightly packed matrix proved.
      - uses: ./.github/actions/setup-workspace
        with:
          node-version: 22.19.0
          playwright-browser: chromium
      - id: changesets
        uses: changesets/action@v2
        with:
          version-script: pnpm version-packages
          # No publish-script: Changesets only opens or refreshes the Version
          # Packages PR. Distribution is the commit-addressed preview above.
          commit-message: Version Packages
          pr-title: Version Packages
          # An external PAT/App token makes the generated PR's native
          # pull_request event run CI directly. With only GITHUB_TOKEN, the
          # step below dispatches CI explicitly so the candidate still gets
          # pre-merge qualification without a manual close/reopen.
          github-token: ${{ secrets.CHANGESETS_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
      # GITHUB_TOKEN-created pushes do not recursively start workflows, but
      # workflow_dispatch is an explicit GitHub exception. ci.yml documents
      # manual dispatch as the full main-push matrix on any ref, including the
      # Node floor and per-PR release-gates job (`pnpm check:release:ci`).
      # release-candidate.yml is the packed-release boundary
      # (`pnpm check:release`) for this same candidate. Skip both when an
      # external Changesets token is configured: that token's pull_request
      # event already starts CI, and its push to changeset-release/main
      # starts release-candidate.yml.
      - name: Dispatch qualification for Version Packages candidate
        if: >-
          steps.changesets.outputs.has-changesets == 'true' &&
          steps.changesets.outputs.pr-number != '' &&
          env.CHANGESETS_TOKEN_CONFIGURED != 'true'
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
        run: |
          set -euo pipefail
          gh workflow run ci.yml --ref changeset-release/main
          gh workflow run release-candidate.yml --ref changeset-release/main

      # When the Version Packages PR lands, prove the versioned tree still
      # passes the packed release gates. `needs: preview` separately proves
      # that every package resolves from pkg.pr.new at this exact commit.
      - name: Release gates for Version Packages merge
        id: qualify
        if: >-
          steps.changesets.outputs.has-changesets == 'false' &&
          startsWith(github.event.head_commit.message, 'Version Packages')
        run: pnpm check:release
      - name: Release outcome summary
        if: always()
        env:
          HAS_CHANGESETS: ${{ steps.changesets.outputs.has-changesets }}
          QUALIFY_OUTCOME: ${{ steps.qualify.outcome }}
          CHANGESETS_OUTCOME: ${{ steps.changesets.outcome }}
          PREVIEW_OUTCOME: ${{ needs.preview.result }}
          JOB_STATUS: ${{ job.status }}
          CANDIDATE_SHA: ${{ github.sha }}
          EVIDENCE_FILE: ${{ env.AGENT_BUNDLE_RELEASE_EVIDENCE }}
          GH_TOKEN: ${{ github.token }}
        run: bash scripts/release-outcome-summary.sh >> "$GITHUB_STEP_SUMMARY"