release.yml

name: 🚀 Release & Publish

# NOTE: This workflow requires a RELEASE_TOKEN secret to bypass branch protection rules
# The token needs the following permissions:
# - repo (full control)
# - workflow
# Without RELEASE_TOKEN, the workflow will fall back to GITHUB_TOKEN.
# NPM publishing uses OIDC Trusted Publishing (no NPM_TOKEN needed).

on:
  push:
    branches: [main]
  workflow_dispatch:
  # NOTE: release trigger removed — semantic-release on push handles NPM, Docker, and DXT.
  # The release: [published] event caused duplicate runs (E403 on NPM, redundant Docker/DXT)
  # because semantic-release creates the GitHub release, which re-triggered this workflow.

env:
  NODE_VERSION: "22"
  HUSKY: 0
  CI: true

jobs:
  # 🏷️ Semantic Release
  semantic-release:
    name: 🏷️ Semantic Release
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    permissions:
      contents: write
      issues: write
      pull-requests: write
      id-token: write # Required for NPM Trusted Publishing (OIDC)
    outputs:
      new-release-published: ${{ steps.semantic.outputs.new_release_published }}
      new-release-version: ${{ steps.semantic.outputs.new_release_version }}
    steps:
      - name: 📥 Checkout Code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          # Use RELEASE_TOKEN if available for bypassing branch protection rules
          # Falls back to GITHUB_TOKEN if RELEASE_TOKEN is not set
          token: ${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}

      - name: 📦 Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: "npm"

      - name: 📦 Install Dependencies
        run: npm ci
        env:
          HUSKY: 0

      - name: 🏗️ Build Project
        run: npm run build
        env:
          HUSKY: 0

      - name: 🧪 Run Essential Tests
        run: |
          # Run core tests that must pass for release
          npm run test:ci || npm run test:typescript
        env:
          WORDPRESS_SITE_URL: https://example.com
          WORDPRESS_USERNAME: test_user
          WORDPRESS_APP_PASSWORD: test_password
          CI: true
          HUSKY: 0

      - name: 🏷️ Semantic Release
        id: semantic
        uses: cycjimmy/semantic-release-action@v6
        with:
          extra_plugins: |
            @semantic-release/changelog@6.0.3
            @semantic-release/git@10.0.1
        env:
          # Use RELEASE_TOKEN if available for bypassing branch protection rules
          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
          HUSKY: 0
          NODE_OPTIONS: "--max-old-space-size=4096"

  # NOTE: Fallback NPM Publish job removed — semantic-release handles NPM publishing
  # via its @semantic-release/npm plugin. The fallback was only useful for manual GitHub
  # releases, but those no longer trigger this workflow (release event removed above).

  # 🐳 Docker Publish
  docker-publish:
    name: 🐳 Publish to Docker Hub
    runs-on: ubuntu-latest
    needs: semantic-release
    if: needs.semantic-release.outputs.new-release-published == 'true'
    permissions:
      contents: read
      packages: write
    steps:
      - name: 📥 Checkout Code
        uses: actions/checkout@v6

      - name: 🐳 Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: 🔐 Log in to Docker Hub
        uses: docker/login-action@v4
        with:
          registry: docker.io
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: 🔍 Verify Docker Login
        run: |
          echo "Verifying Docker Hub login..."
          docker info
          echo "Docker Hub login successful"

      - name: 🔍 Debug Release Info
        run: |
          echo "Release info debug:"
          echo "New release published: ${{ needs.semantic-release.outputs.new-release-published }}"
          echo "New release version: ${{ needs.semantic-release.outputs.new-release-version }}"
          echo "GitHub ref: ${{ github.ref }}"
          echo "GitHub ref name: ${{ github.ref_name }}"
          echo "Event name: ${{ github.event_name }}"
          echo "Is tag: ${{ startsWith(github.ref, 'refs/tags/') }}"
          echo "Current working directory:"
          pwd
          echo "Git status:"
          git status || true
          echo "Git tags:"
          git tag --sort=-version:refname | head -5 || true

      - name: 📝 Extract Metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: docker.io/docdyhr/mcp-wordpress
          tags: |
            type=ref,event=branch
            type=raw,value=${{ needs.semantic-release.outputs.new-release-version }},enable=${{ needs.semantic-release.outputs.new-release-published == 'true' }}
            type=raw,value=latest,enable={{is_default_branch}}
          labels: |
            org.opencontainers.image.title=MCP WordPress Server
            org.opencontainers.image.description=Complete WordPress MCP Server with 59 management tools, intelligent caching, and real-time monitoring
            org.opencontainers.image.version=${{ needs.semantic-release.outputs.new-release-version || github.ref_name }}
            org.opencontainers.image.revision=${{ github.sha }}
            org.opencontainers.image.created={{date 'YYYY-MM-DDTHH:mm:ssZ'}}
            org.opencontainers.image.source=https://github.com/docdyhr/mcp-wordpress
            org.opencontainers.image.url=https://github.com/docdyhr/mcp-wordpress
            org.opencontainers.image.documentation=https://github.com/docdyhr/mcp-wordpress#readme
            org.opencontainers.image.licenses=MIT

      - name: 🔍 Debug Extracted Tags
        env:
          META_TAGS: ${{ steps.meta.outputs.tags }}
          META_LABELS: ${{ steps.meta.outputs.labels }}
          META_JSON: ${{ steps.meta.outputs.json }}
        run: |
          echo "Extracted tags:"
          echo "${META_TAGS}"
          echo ""
          echo "Extracted labels:"
          echo "${META_LABELS}"
          echo ""
          echo "Metadata JSON:"
          echo "${META_JSON}" | jq . 2>/dev/null || echo "${META_JSON}"

      - name: 🏗️ Build and Push Docker Image
        id: docker-build
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            VERSION=${{ needs.semantic-release.outputs.new-release-version || github.ref_name }}
            BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')
            VCS_REF=${{ github.sha }}
          # v6 features
          provenance: true
          sbom: true

      - name: 🔄 Retry Docker Build on Failure
        if: failure() && steps.docker-build.outcome == 'failure'
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            VERSION=${{ needs.semantic-release.outputs.new-release-version || github.ref_name }}
            BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')
            VCS_REF=${{ github.sha }}
          provenance: true
          sbom: true

      - name: 📝 Update Docker Hub Description
        uses: peter-evans/dockerhub-description@v5
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
          repository: docdyhr/mcp-wordpress
          readme-filepath: ./README.md

      - name: 🎯 Verify Docker Push Success
        id: verify-docker
        env:
          META_TAGS: ${{ steps.meta.outputs.tags }}
          RELEASE_VERSION: ${{ needs.semantic-release.outputs.new-release-version || github.ref_name }}
        run: |
          echo "Docker build and push completed successfully"
          echo "Published tags:"
          echo "${META_TAGS}"
          echo ""
          echo "Version: ${RELEASE_VERSION}"

          # Wait for Docker Hub propagation
          echo "Waiting for Docker Hub propagation..."
          sleep 30

          # Verify the image was pushed successfully
          VERSION="${RELEASE_VERSION}"
          echo "Verifying Docker Hub publishing for version: $VERSION"

          # Try to pull the image to verify it exists
          if docker pull docdyhr/mcp-wordpress:$VERSION; then
            echo "✅ Successfully verified Docker image on Docker Hub"
            echo "verification_status=success" >> $GITHUB_OUTPUT
          else
            echo "❌ Failed to verify Docker image on Docker Hub"
            echo "verification_status=failure" >> $GITHUB_OUTPUT
            exit 1
          fi

      - name: 🚨 Docker Verification Failed - Create Alert
        if: failure() && steps.verify-docker.outputs.verification_status == 'failure'
        run: |
          echo "::error title=Docker Publishing Verification Failed::Failed to verify Docker image publication"
          echo "Manual intervention may be required to publish the Docker image"

  # 📦 DXT Package Build and Upload
  dxt-package:
    name: 📦 Build and Upload DXT Package
    runs-on: ubuntu-latest
    needs: [semantic-release]
    if: needs.semantic-release.result == 'success' && needs.semantic-release.outputs.new-release-published == 'true'
    permissions:
      contents: write
    steps:
      - name: 📥 Checkout Release Tag
        uses: actions/checkout@v6
        with:
          # Checkout the release tag so package.json has the bumped version
          ref: v${{ needs.semantic-release.outputs.new-release-version }}
          fetch-depth: 0

      - name: 📦 Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: "npm"

      - name: 📦 Install Dependencies
        run: npm ci
        env:
          HUSKY: 0

      - name: 📦 Install DXT CLI
        run: npm install -g @anthropic-ai/dxt
        env:
          HUSKY: 0

      - name: 🎁 Build DXT Package
        run: npm run dxt:package:official
        env:
          HUSKY: 0

      - name: 🔍 Verify DXT Package
        run: |
          ls -la mcp-wordpress.dxt
          echo "DXT package size: $(du -h mcp-wordpress.dxt | cut -f1)"
          file mcp-wordpress.dxt
          # Verify version matches the release
          node -e "const m = require('./package.json'); if (m.version !== '${{ needs.semantic-release.outputs.new-release-version }}') { console.error('Version mismatch:', m.version, 'vs', '${{ needs.semantic-release.outputs.new-release-version }}'); process.exit(1); } else { console.log('Version verified:', m.version); }"

      - name: 📤 Upload DXT Package to Release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: v${{ needs.semantic-release.outputs.new-release-version }}
          files: mcp-wordpress.dxt
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: ✅ DXT Package Upload Success
        run: |
          echo "✅ DXT package uploaded successfully!"
          echo "📦 Package: mcp-wordpress.dxt"
          echo "🏷️ Version: ${{ needs.semantic-release.outputs.new-release-version }}"
          echo "🔗 Download URL: https://github.com/docdyhr/mcp-wordpress/releases/download/v${{ needs.semantic-release.outputs.new-release-version }}/mcp-wordpress.dxt"

  # 🎉 Post-Release Actions
  post-release:
    name: 🎉 Post-Release Actions
    runs-on: ubuntu-latest
    needs: [semantic-release, docker-publish, dxt-package]
    if: always() && needs.semantic-release.outputs.new-release-published == 'true'
    steps:
      - name: 📊 Release Summary
        run: |
          echo "🎉 Release Pipeline Summary"
          echo "=========================="
          echo "🏷️ Version: ${{ needs.semantic-release.outputs.new-release-version }}"
          echo "📦 NPM: Published (via semantic-release)"
          echo "🐳 Docker Status: ${{ needs.docker-publish.result }}"
          echo "📦 DXT Package Status: ${{ needs.dxt-package.result }}"
          echo "🔄 Semantic Release: ${{ needs.semantic-release.result }}"
          echo "=========================="

      - name: ✅ Success Notification
        if:
          needs.semantic-release.result == 'success' && needs.docker-publish.result == 'success' &&
          needs.dxt-package.result == 'success'
        run: |
          echo "🎉 Release completed successfully!"
          echo "✅ All components published successfully"
          echo "📦 NPM: Published"
          echo "🐳 Docker: Published"
          echo "📦 DXT Package: Uploaded"

      - name: 🚨 Failure Notification
        if:
          needs.semantic-release.result == 'failure' || needs.docker-publish.result == 'failure' ||
          needs.dxt-package.result == 'failure'
        run: |
          echo "❌ Release had failures!"
          echo "Please check the workflow logs and fix any issues."
          echo "Semantic Release: ${{ needs.semantic-release.result }}"
          echo "Docker Publish: ${{ needs.docker-publish.result }}"
          echo "DXT Package: ${{ needs.dxt-package.result }}"
          exit 1