release.yml

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write # create the GitHub Release
  id-token: write # OIDC: npm trusted publishing + provenance (no NPM_TOKEN)
  packages: write # push the Docker image to GHCR

jobs:
  release:
    name: Publish to npm
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-node@v6
        with:
          node-version: 22
          registry-url: 'https://registry.npmjs.org'
          cache: npm

      # Trusted publishing requires a recent npm (>= 11.5.1).
      - run: npm install -g npm@latest

      - run: npm ci

      # Gate the release on the same checks as CI.
      - run: npm run lint
      - run: npm run test:coverage

      # Auth is via OIDC trusted publishing (configure the trusted publisher
      # for this repo/workflow at npmjs.com first). Provenance is attached
      # automatically; no NPM_TOKEN secret is needed. Skips when this version
      # is already on npm (manual first publish, or a re-run of the tag).
      - name: Publish to npm (skip if already published)
        run: |
          VERSION=$(node -p "require('./package.json').version")
          if npm view "@wavyx/hscli@$VERSION" version >/dev/null 2>&1; then
            echo "@wavyx/hscli@$VERSION already published — skipping"
          else
            npm publish --provenance
          fi

      - name: Create GitHub Release from CHANGELOG (skip if exists)
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          if gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1; then
            echo "Release $GITHUB_REF_NAME already exists — skipping"
            exit 0
          fi
          VERSION="${GITHUB_REF_NAME#v}"
          NOTES=$(awk -v ver="$VERSION" '
            $0 ~ "^## \\[" ver "\\]" { flag=1; next }
            /^## \[/ { flag=0 }
            flag { print }
          ' CHANGELOG.md)
          gh release create "$GITHUB_REF_NAME" \
            --title "$GITHUB_REF_NAME" \
            --notes "${NOTES:-Release $GITHUB_REF_NAME}"

  docker:
    name: Publish Docker image
    needs: release # build from the just-published npm version
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Resolve version
        id: ver
        run: echo "v=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - uses: docker/setup-qemu-action@v4 # cross-build arm64

      - uses: docker/setup-buildx-action@v4

      - uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: docker/build-push-action@v7
        with:
          context: .
          push: true
          platforms: linux/amd64,linux/arm64
          build-args: HSCLI_VERSION=${{ steps.ver.outputs.v }}
          tags: |
            ghcr.io/${{ github.repository }}:${{ steps.ver.outputs.v }}
            ghcr.io/${{ github.repository }}:latest