release.yml

name: Release

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      announcement_dry_run:
        description: "Generate release announcement copy without publishing to Discord or X"
        required: false
        default: false
        type: boolean
      widget_recovery_version:
        description: "Re-upload an already-published browser widget version after a partial release"
        required: false
        type: string

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: write
  pull-requests: write
  id-token: write

jobs:
  release:
    if: github.repository_owner == 'cossistantcom'
    runs-on: ubuntu-latest
    env:
      AWS_ROLE_ARN: ${{ vars.AWS_ROLE_ARN || secrets.AWS_ROLE_ARN }}
      CLOUDFRONT_DISTRIBUTION_ID: ${{ vars.CLOUDFRONT_DISTRIBUTION_ID || secrets.CLOUDFRONT_DISTRIBUTION_ID }}
      S3_BUCKET_NAME: ${{ vars.S3_BUCKET_NAME || secrets.S3_BUCKET_NAME }}
      S3_CDN_BASE_URL: ${{ vars.S3_CDN_BASE_URL || secrets.S3_CDN_BASE_URL }}
      S3_REGION: ${{ vars.S3_REGION || secrets.S3_REGION }}
      WIDGET_CDN_PREFIX: widget
      WIDGET_S3_PREFIX: cdn/widget
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          registry-url: "https://registry.npmjs.org"

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.1

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Check types
        run: bun run check-types

      - name: Check documentation content
        run: bun run check:docs-content

      - name: Build example integration app
        run: bun run build --filter @cossistant/example-nextjs-tailwind

      - name: Build browser embed package
        run: bun run build --filter @cossistant/browser

      - name: Check browser embed bundle size
        run: bun run check:browser-embed-size

      - name: Create Release PR or Publish
        id: changesets
        uses: changesets/action@v1
        with:
          version: node .github/changeset-version.js
          publish: bun run changeset:publish
          title: "chore(release): version packages"
          commit: "chore(release): version packages"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}

      - name: Resolve published React/browser packages
        if: steps.changesets.outputs.published == 'true' || (github.event_name == 'workflow_dispatch' && inputs.widget_recovery_version != '')
        id: browser_package
        uses: actions/github-script@v7
        env:
          PACKAGES: ${{ steps.changesets.outputs.publishedPackages }}
          RECOVERY_VERSION: ${{ inputs.widget_recovery_version }}
        with:
          script: |
            const fs = require("fs");
            const path = require("path");
            const packages = JSON.parse(process.env.PACKAGES ?? "[]");
            const recoveryVersion = process.env.RECOVERY_VERSION?.trim() ?? "";
            const react = packages.find((pkg) => pkg.name === "@cossistant/react");
            const browser = packages.find((pkg) => pkg.name === "@cossistant/browser");

            if (recoveryVersion) {
              if (packages.length > 0) {
                core.setFailed(
                  "Widget recovery cannot run in the same workflow as a new package publication."
                );
                return;
              }

              if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(recoveryVersion)) {
                core.setFailed(`Invalid widget recovery version: ${recoveryVersion}`);
                return;
              }

              const manifestPath = path.join(
                process.env.GITHUB_WORKSPACE,
                "packages/browser/package.json"
              );
              const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));

              if (manifest.version !== recoveryVersion) {
                core.setFailed(
                  `Widget recovery version ${recoveryVersion} does not match @cossistant/browser@${manifest.version}.`
                );
                return;
              }

              core.setOutput("published", "true");
              core.setOutput("version", recoveryVersion);
              core.info(
                `Recovering CDN assets for @cossistant/browser@${recoveryVersion}.`
              );
              return;
            }

            if (react && browser && react.version !== browser.version) {
              core.setFailed(
                `Expected @cossistant/react and @cossistant/browser to share a version, got ${react.version} and ${browser.version}.`
              );
              return;
            }

            const shouldUploadWidget = Boolean(react && browser);

            core.setOutput("published", shouldUploadWidget ? "true" : "false");
            core.setOutput("version", browser?.version ?? "");

            if (shouldUploadWidget) {
              core.info(
                `Published @cossistant/react@${react.version} and @cossistant/browser@${browser.version}; widget CDN upload enabled.`
              );
            } else if (react && !browser) {
              core.setFailed(
                "Published @cossistant/react without @cossistant/browser. Widget CDN upload requires both packages in the same release."
              );
            } else if (!react && browser) {
              core.setFailed(
                "Published @cossistant/browser without @cossistant/react. Widget CDN upload requires the React package to be published."
              );
            } else {
              core.notice(
                "React package was not published in this release run; skipping widget CDN upload."
              );
            }

      - name: Validate widget CDN configuration
        if: steps.browser_package.outputs.published == 'true'
        shell: bash
        run: |
          required_vars=(
            AWS_ROLE_ARN
            CLOUDFRONT_DISTRIBUTION_ID
            S3_BUCKET_NAME
            S3_CDN_BASE_URL
            S3_REGION
          )

          for name in "${required_vars[@]}"; do
            if [ -z "${!name}" ]; then
              echo "::error::Missing required workflow variable: ${name}"
              exit 1
            fi
          done

      - name: Configure AWS credentials
        if: steps.browser_package.outputs.published == 'true'
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ env.S3_REGION }}
          role-to-assume: ${{ env.AWS_ROLE_ARN }}

      - name: Upload browser CDN assets
        if: steps.browser_package.outputs.published == 'true'
        shell: bash
        env:
          BROWSER_VERSION: ${{ steps.browser_package.outputs.version }}
        run: |
          version_prefix="s3://${S3_BUCKET_NAME}/${WIDGET_S3_PREFIX}/${BROWSER_VERSION}"
          latest_prefix="s3://${S3_BUCKET_NAME}/${WIDGET_S3_PREFIX}/latest"

          for file in loader.js widget.js widget.css; do
            local_path="packages/browser/dist/embed/${file}"

            if [[ "${file}" == *.css ]]; then
              content_type="text/css; charset=utf-8"
            else
              content_type="text/javascript; charset=utf-8"
            fi

            aws s3 cp "${local_path}" "${version_prefix}/${file}" \
              --cache-control "public, max-age=31536000, immutable" \
              --content-type "${content_type}"

            aws s3 cp "${local_path}" "${latest_prefix}/${file}" \
              --cache-control "public, max-age=300, must-revalidate" \
              --content-type "${content_type}"
          done

          cdn_base_url="${S3_CDN_BASE_URL%/}"
          {
            echo "## Browser Widget CDN"
            echo ""
            echo "- Versioned loader: ${cdn_base_url}/${WIDGET_CDN_PREFIX}/${BROWSER_VERSION}/loader.js"
            echo "- Latest loader: ${cdn_base_url}/${WIDGET_CDN_PREFIX}/latest/loader.js"
          } >> "${GITHUB_STEP_SUMMARY}"

      - name: Invalidate latest widget assets
        if: steps.browser_package.outputs.published == 'true'
        run: |
          aws cloudfront create-invalidation \
            --distribution-id "${CLOUDFRONT_DISTRIBUTION_ID}" \
            --paths "/${WIDGET_CDN_PREFIX}/latest/*"

      - name: Create GitHub releases
        if: steps.changesets.outputs.published == 'true'
        uses: actions/github-script@v7
        env:
          PACKAGES: ${{ steps.changesets.outputs.publishedPackages }}
        with:
          script: |
            const packages = JSON.parse(process.env.PACKAGES ?? "[]");
            if (!packages.length) {
              core.notice("No packages published, skipping release creation.");
              return;
            }

            const { execSync } = require("child_process");

            for (const pkg of packages) {
              const tag = `${pkg.name}@${pkg.version}`;
              let body = "";

              try {
                body = execSync(`node .github/generate-release-notes.js ${tag}`, {
                  cwd: process.env.GITHUB_WORKSPACE,
                  stdio: ["ignore", "pipe", "inherit"],
                }).toString();
              } catch (error) {
                core.warning(`Failed to generate release notes for ${tag}: ${error.message}`);
                body = `${tag} published via Changesets.`;
              }

              try {
                await github.rest.repos.createRelease({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  tag_name: tag,
                  name: `${pkg.name} v${pkg.version}`,
                  body,
                  draft: false,
                  prerelease: false,
                });
                core.info(`Created release for ${tag}`);
              } catch (error) {
                if (error.status === 422) {
                  core.warning(`Release for ${tag} already exists. Skipping.`);
                } else {
                  throw error;
                }
              }
            }

      - name: Announce widget release
        if: steps.browser_package.outputs.published == 'true'
        continue-on-error: true
        env:
          ANNOUNCEMENT_CHANGELOG_BASE_URL: ${{ vars.ANNOUNCEMENT_CHANGELOG_BASE_URL }}
          BROWSER_VERSION: ${{ steps.browser_package.outputs.version }}
          DISCORD_RELEASE_WEBHOOK_URL: ${{ secrets.DISCORD_RELEASE_WEBHOOK_URL }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REPOSITORY: ${{ github.repository }}
          X_CONSUMER_KEY: ${{ secrets.X_CONSUMER_KEY }}
          X_CONSUMER_KEY_SECRET: ${{ secrets.X_CONSUMER_KEY_SECRET }}
          X_ACCESS_TOKEN: ${{ secrets.X_ACCESS_TOKEN }}
          X_ACCESS_TOKEN_SECRET: ${{ secrets.X_ACCESS_TOKEN_SECRET }}
        shell: bash
        run: |
          args=(
            --version "${BROWSER_VERSION}"
            --repo "${REPOSITORY}"
          )

          if [[ "${{ github.event_name }}" == "workflow_dispatch" && "${{ inputs.announcement_dry_run }}" == "true" ]]; then
            args+=(--dry-run)
          fi

          bun run packages/release/src/announce-widget-release.ts "${args[@]}"