release.yml

# Changesets-driven release. A green CI run on main either opens/updates the
# Version Packages PR, or publishes the release after that PR merges.
#
# Version PR path:
#   - contributors commit `.changeset/*.md` files;
#   - `.github/changeset-version.mjs` applies the pending versions;
#   - create-pull-request commits those changes to the `release` branch;
#   - the Version Packages PR includes package versions, changelogs, lockfile
#     updates, and the Dockerfile/docs pins for the computerd image;
#   - this workflow dispatches CI on `release`, which publishes the package
#     preview and lets the branch image workflow publish `:next`.
#
# Publish path:
#   - no pending changesets remain on main;
#   - changesets/action runs `.github/changeset-publish.mjs`;
#   - the script builds and pushes the computerd container image first, then
#     runs `changeset publish` for npm. Reruns are safe: pushing the same image
#     tags again is idempotent, and changeset publish skips npm versions that
#     already exist.

name: Release

on:
  workflow_run:
    workflows: ["CI"]
    branches: [main]
    types: [completed]
  workflow_dispatch: {}

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

jobs:
  release:
    if: ${{ (github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success') && github.repository_owner == 'cloudflare' }}
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      # The version path dispatches CI for the release branch.
      actions: write
      # Trusted publishing on npm requires the OIDC id-token.
      id-token: write
      # changesets/action creates the version PR, release commit, and tags.
      contents: write
      pull-requests: write
      # GHCR push uses GITHUB_TOKEN with `packages: write`.
      packages: write
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 1

      - uses: ./.github/actions/install
        with:
          registry-url: "https://registry.npmjs.org"

      # @cloudflare/computer's prepublishOnly runs `npm run build && npm
      # test`; its tests spawn the computerd binary, which dynamically links
      # libfuse2 and uses fuse3 helpers for the FUSE_MOUNT=shim path. Without
      # these the suite fails with `libfuse.so.2: cannot open shared object
      # file`. Mirrors ci.yml.
      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends libfuse2t64 fuse3

      # Build every workspace's dist/ up front. changesets doesn't run the
      # build itself (changesets/changesets#860), and package builds/tests
      # resolve sibling dist/ directories.
      - name: Build all workspaces
        run: npm run build --workspaces --if-present

      - name: Detect pending changesets
        id: pending-changesets
        shell: bash
        run: |
          shopt -s nullglob
          files=()
          for file in .changeset/*.md; do
            if [[ "$file" == ".changeset/README.md" ]]; then
              continue
            fi
            files+=("$file")
          done
          if [[ ${#files[@]} -gt 0 ]]; then
            echo "present=true" >> "$GITHUB_OUTPUT"
          else
            echo "present=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Capture the release plan
        if: steps.pending-changesets.outputs.present == 'true'
        run: npx changeset status --output .changeset/release-status.json

      - name: Version packages
        if: steps.pending-changesets.outputs.present == 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: node .github/changeset-version.mjs

      - name: Build the Version Packages PR body
        if: steps.pending-changesets.outputs.present == 'true'
        run: |
          trap 'rm -f .changeset/release-status.json' EXIT
          node .github/changeset-pr-body.mjs \
            .changeset/release-status.json \
            "$RUNNER_TEMP/changeset-pr-body.md"

      # changesets/action fixes its branch name to changeset-release/<base>.
      # Use create-pull-request so the stable Version Packages branch is the
      # shorter `release` name.
      - name: Create or update the Version Packages PR
        id: version-pr
        if: steps.pending-changesets.outputs.present == 'true'
        uses: peter-evans/create-pull-request@v8
        with:
          branch: release
          base: main
          commit-message: Version Packages
          committer: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
          author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
          title: Version Packages
          body-path: ${{ runner.temp }}/changeset-pr-body.md

      - name: Close the old Version Packages PR
        if: steps.version-pr.outputs.pull-request-number
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION_PR: ${{ steps.version-pr.outputs.pull-request-number }}
        run: |
          old_pr="$(gh pr list --repo "$GITHUB_REPOSITORY" --state open \
            --base main --head changeset-release/main --json number \
            --jq '.[0].number // empty')"
          if [[ -n "$old_pr" ]]; then
            gh pr close "$old_pr" --repo "$GITHUB_REPOSITORY" --delete-branch \
              --comment "Superseded by #$VERSION_PR after the release branch was renamed."
          fi

      # The following Docker setup is only needed on the publish path. The
      # Version Packages PR path should not need registry credentials.
      - name: Set up buildx
        if: steps.pending-changesets.outputs.present == 'false'
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        if: steps.pending-changesets.outputs.present == 'false'
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Log in to registry.cloudflare.com
        if: steps.pending-changesets.outputs.present == 'false'
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        run: |
          source .github/cf-registry-login.sh
          cf_registry_credentials 30 '["pull", "push", "library_push"]'
          echo "$CF_REGISTRY_PASSWORD" | docker login registry.cloudflare.com \
            -u "$CF_REGISTRY_USERNAME" --password-stdin

      - id: changesets
        if: steps.pending-changesets.outputs.present == 'false'
        uses: changesets/action@v1
        with:
          publish: node .github/changeset-publish.mjs
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_CONFIG_PROVENANCE: "true"

      # A branch update made with GITHUB_TOKEN cannot trigger a push workflow.
      # workflow_dispatch is exempt from that recursion guard.
      - name: Run CI on the version branch
        if: steps.pending-changesets.outputs.present == 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh workflow run ci.yml --ref release