release.yml

name: Release

on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: release
  cancel-in-progress: false

permissions:
  contents: write
  pull-requests: write

jobs:
  release-please:
    name: Release pull request, tag and notes
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: googleapis/release-please-action@v5
        id: release
        with:
          config-file: .github/release-please-config.json
          manifest-file: .github/.release-please-manifest.json
          target-branch: main
          token: ${{ secrets.AUTOMATION_TOKEN || secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}

      # `release` carries a ruleset that requires a pull request, and the only
      # bypass is the admin role. So this cannot push a merge commit itself:
      # the REST `merges` API writes straight to the branch, the ruleset refused
      # it, and every tag from v1.6.1 on was cut on `main` and never shipped —
      # production sat on whatever pull request last reached `release` by hand.
      # A pull request from `main` is the one door that is open, which is also
      # what `pr-base.yml` assumes when it leaves a `main` head alone.
      - name: Put the tag on release
        if: steps.release.outputs.tag_name || github.event_name == 'workflow_dispatch'
        env:
          GH_TOKEN: ${{ secrets.AUTOMATION_TOKEN || secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          TAG: ${{ steps.release.outputs.tag_name }}
          URL: ${{ steps.release.outputs.html_url }}
        run: |
          set -euo pipefail

          tag="${TAG:-$(gh release view --json tagName --jq .tagName)}"
          url="${URL:-$(gh release view "$tag" --json url --jq .url)}"

          if [ "$(gh api "repos/$GH_REPO/compare/release...main" --jq .ahead_by)" = "0" ]; then
            echo "Released [$tag]($url); \`release\` already had it." >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi

          number=$(gh pr list --base release --head main --state open --limit 1 --json number --jq '.[0].number // empty')

          if [ -z "$number" ]; then
            gh pr create --base release --head main \
              --title "release: $tag" \
              --body "Puts [$tag]($url) on \`release\`, which is the branch production deploys from. Opened by the Release workflow."
            number=$(gh pr list --base release --head main --state open --limit 1 --json number --jq '.[0].number')
          fi

          for _ in 1 2 3 4 5; do
            if out=$(gh pr merge "$number" --merge 2>&1); then
              echo "Released [$tag]($url) and put it on \`release\` in #$number. It is live." >> "$GITHUB_STEP_SUMMARY"
              exit 0
            fi
            sleep 5
          done

          {
            echo "**[$tag]($url) is tagged but did not reach \`release\`.**"
            echo
            echo "#$number is open and merging it ships this release."
            echo
            echo "\`\`\`"
            echo "$out"
            echo "\`\`\`"
          } >> "$GITHUB_STEP_SUMMARY"

          exit 1

      - name: Say what happened
        if: ${{ !steps.release.outputs.tag_name }}
        run: |
          set -euo pipefail
          echo "No tag this run — either the release pull request is still open, or nothing releasable landed." >> "$GITHUB_STEP_SUMMARY"

      - name: Fail on a merged release pull request that was never tagged
        env:
          GH_TOKEN: ${{ secrets.AUTOMATION_TOKEN || secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail

          candidates=$(gh pr list --repo "$GITHUB_REPOSITORY" --base main --state merged --label "autorelease: pending" --limit 20 --json number --jq '.[].number')

          stuck=""

          for pr in $candidates; do
            state=$(gh api "repos/$GITHUB_REPOSITORY/issues/$pr/labels" --jq 'map(.name) | if index("autorelease: tagged") then "tagged" elif index("autorelease: pending") then "pending" else "cleared" end')

            if [ "$state" != "pending" ]; then
              continue
            fi

            title=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$pr" --jq '.title')
            stuck="${stuck}#${pr} ${title}"$'\n'
          done

          if [ -z "$stuck" ]; then
            exit 0
          fi

          {
            echo "**A merged release pull request was never tagged.** release-please aborts on it, so nothing"
            echo "releases and no release pull request opens until it is cleared: create the tag and GitHub"
            echo "Release at that pull request's merge commit, then swap its \`autorelease: pending\` label for"
            echo "\`autorelease: tagged\`."
            echo
            echo '```'
            echo "$stuck"
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"

          exit 1