release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag (e.g., v1.0.0)'
        required: true
        type: string
      modules:
        description: 'Module groups to release'
        required: false
        type: choice
        default: 'all'
        options:
          - all
          - go
          - npm
          - flutter
          - go+npm
          - go+flutter
          - npm+flutter
      dry_run:
        description: 'Dry run (skip actual publish)'
        required: false
        type: boolean
        default: false

permissions:
  contents: write
  id-token: write

jobs:
  # ─── Prepare ─────────────────────────────────────────────────────────
  prepare:
    name: Prepare Release
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.set-tag.outputs.tag }}
      version: ${{ steps.set-tag.outputs.version }}

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Set release tag and version
        id: set-tag
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            TAG="${{ github.event.inputs.tag }}"
            echo "Creating tag $TAG"
            git config user.name "github-actions[bot]"
            git config user.email "github-actions[bot]@users.noreply.github.com"
            git tag "$TAG"
            git push origin "$TAG"
          else
            TAG="${{ github.ref_name }}"
          fi
          VERSION="${TAG#v}"
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Release tag: $TAG, version: $VERSION"

      - name: Generate release notes
        id: notes
        run: |
          PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
          if [ -z "$PREV_TAG" ]; then
            NOTES=$(git log --pretty=format:"- %s (%h)" HEAD)
          else
            NOTES=$(git log --pretty=format:"- %s (%h)" ${PREV_TAG}..HEAD)
          fi
          {
            echo "notes<<EOF"
            echo "$NOTES"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Create GitHub release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.set-tag.outputs.tag }}
          body: |
            ## Changes

            ${{ steps.notes.outputs.notes }}

            ---

            ### Installation

            **Go:**
            ```bash
            go get github.com/xraph/authsome@${{ steps.set-tag.outputs.tag }}
            ```

            **npm:**
            ```bash
            npm install @authsome/client@${{ steps.set-tag.outputs.version }}
            npm install @authsome/ui-react@${{ steps.set-tag.outputs.version }}
            ```

            **Flutter:**
            ```yaml
            dependencies:
              authsome_flutter: ^${{ steps.set-tag.outputs.version }}
            ```
          generate_release_notes: true

  # ─── Go Release ──────────────────────────────────────────────────────
  go-release:
    name: Go Release
    runs-on: ubuntu-latest
    needs: [prepare]
    if: >-
      github.event_name == 'push' ||
      github.event.inputs.modules == 'all' ||
      contains(github.event.inputs.modules, 'go')

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          cache: true
          cache-dependency-path: go.sum

      - name: Verify build
        run: |
          go mod download
          go build ./...
          go test -race -count=1 ./...

  # ─── npm Release ─────────────────────────────────────────────────────
  npm-release:
    name: npm Release
    runs-on: ubuntu-latest
    needs: [prepare]
    if: >-
      github.event_name == 'push' ||
      github.event.inputs.modules == 'all' ||
      contains(github.event.inputs.modules, 'npm')
    env:
      NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22"
          registry-url: "https://registry.npmjs.org"

      - name: Upgrade npm for trusted publishing
        # Trusted publishing (OIDC) + provenance require npm >= 11.5.1.
        run: npm install -g npm@latest

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9

      - name: Install UI dependencies
        run: cd ui && pnpm install --frozen-lockfile

      - name: Build UI packages
        run: cd ui && pnpm run build

      - name: Build SDK TypeScript
        run: |
          cd sdk/typescript
          npm install
          npm run build

      - name: Prepare packages for publishing
        run: |
          chmod +x scripts/prepare-npm-publish.sh
          ./scripts/prepare-npm-publish.sh "${{ needs.prepare.outputs.version }}"

      - name: Publish @authsome/client
        run: |
          cd sdk/typescript
          npm publish --provenance --access public ${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}

      - name: Publish @authsome/ui-core
        run: |
          cd ui/packages/core
          npm publish --provenance --access public ${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}

      - name: Publish @authsome/ui-react
        run: |
          cd ui/packages/react
          npm publish --provenance --access public ${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}

      - name: Publish @authsome/ui-vue
        run: |
          cd ui/packages/vue
          npm publish --provenance --access public ${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}

      - name: Publish @authsome/ui-components
        run: |
          cd ui/packages/components
          npm publish --provenance --access public ${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}

      - name: Publish @authsome/ui-nextjs
        run: |
          cd ui/packages/nextjs
          npm publish --provenance --access public ${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}

  # ─── Flutter/pub.dev Release ─────────────────────────────────────────
  # Authentication is OIDC, provisioned inside the reusable workflow -- there is
  # no pub credential to configure here. Two consequences:
  #
  #   1. Each package must have tag pattern `v{{version}}` set under
  #      Admin -> Automated publishing on pub.dev, and its `version:` in
  #      pubspec.yaml must equal the tag's version. The versions are therefore
  #      committed (bump them with scripts/bump-flutter-version.sh before
  #      tagging) rather than stamped during the run.
  #   2. pub.dev rejects automated publishing from anything but a tag push, so a
  #      workflow_dispatch run can only ever rehearse. dry-run is forced on for
  #      those, which is also what the dry_run input maps to on a tag push.
  flutter-release:
    name: Flutter Release
    needs: [prepare]
    if: >-
      github.event_name == 'push' ||
      github.event.inputs.modules == 'all' ||
      contains(github.event.inputs.modules, 'flutter')
    uses: xraph/workflows/.github/workflows/pub-publish.yml@v1
    with:
      # Ordered: authsome_flutter depends on authsome_core, and
      # authsome_flutter_ui depends on authsome_flutter.
      packages: '["flutter/packages/authsome_core", "flutter/packages/authsome_flutter", "flutter/packages/authsome_flutter_ui"]'
      dry-run: ${{ github.event_name != 'push' || github.event.inputs.dry_run == 'true' }}