release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: "patch, minor, major, or an exact stable version"
        required: true
        default: "patch"
        type: string
      announcement:
        description: "Optional announcement, saved before the generated changelog"
        required: false
        type: string
      release_tag:
        description: "Existing release tag to resume publication without another version bump"
        required: false
        type: string

permissions: {}

env:
  GH_REPO: ${{ github.repository }}

concurrency:
  # Serialize releases across branches so maintenance releases cannot race latest.
  group: release
  cancel-in-progress: false

jobs:
  preflight:
    name: Release compatibility checks
    permissions:
      contents: read
    uses: ./.github/workflows/ci.yml
    with:
      full: true

  prepare:
    name: Prepare release PR and lockfiles
    needs: preflight
    if: inputs.release_tag == ''
    runs-on: macos-26
    timeout-minutes: 40
    permissions:
      contents: write
      pull-requests: write
      issues: write
    outputs:
      pr: ${{ steps.prepare.outputs.pr }}
      version: ${{ steps.prepare.outputs.version }}
    env:
      # A separate token makes GitHub run the usual PR checks on automated commits.
      GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.RELEASE_IT_GITHUB_TOKEN }}
      RELEASE_INCREMENT: ${{ inputs.version }}
    steps:
      - name: Check release credentials
        run: |
          if [ -z "$GH_TOKEN" ]; then
            echo "Configure RELEASE_PLEASE_TOKEN with contents, pull requests, and issues write access." >&2
            exit 1
          fi
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          ref: ${{ github.sha }}
          persist-credentials: false
      - uses: actions/setup-node@v7
        with:
          node-version: 24
          package-manager-cache: false
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.1
      - name: Install release tooling
        run: bun install --frozen-lockfile
      - name: Test release automation
        run: |
          bun run test:release
          bun run typecheck:release
      - name: Create or refresh release PR
        id: prepare
        run: node scripts/prepare-release.ts
      - name: Check out release PR
        uses: actions/checkout@v7
        with:
          ref: ${{ steps.prepare.outputs.branch }}
          token: ${{ env.GH_TOKEN }}
          fetch-depth: 0
          persist-credentials: false
      - name: Synchronize workspace lockfile
        run: |
          bun install --lockfile-only --ignore-scripts
          bun run sync:lockfile
          bun run check:lockfile
          bun install --frozen-lockfile
      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: 3.3.0
          bundler-cache: true
          working-directory: example
      - name: Select Xcode
        run: sudo xcode-select -s "/Applications/Xcode_26.5.app/Contents/Developer"
      - name: Update iOS and macOS lockfiles
        run: |
          bun example pods
          bun example pods:macos
      - name: Commit lockfiles and optional announcement
        run: node scripts/commit-release-lockfiles.ts
        env:
          RELEASE_BRANCH: ${{ steps.prepare.outputs.branch }}
          RELEASE_ANNOUNCEMENT: ${{ inputs.announcement }}

  merge:
    name: Wait for checks, merge and tag release
    needs: prepare
    runs-on: ubuntu-24.04
    timeout-minutes: 70
    permissions:
      contents: write
      pull-requests: write
      issues: write
    outputs:
      tag: ${{ steps.release.outputs.tag }}
    env:
      GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.RELEASE_IT_GITHUB_TOKEN }}
      RELEASE_PR: ${{ needs.prepare.outputs.pr }}
      RELEASE_VERSION: ${{ needs.prepare.outputs.version }}
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.sha }}
          persist-credentials: false
      - uses: actions/setup-node@v7
        with:
          node-version: 24
          package-manager-cache: false
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.1
      - run: bun install --frozen-lockfile
      - name: Merge when GitHub permits, then create a tagged draft
        id: release
        run: node scripts/merge-release.ts

  publish:
    name: Publish both packages from the release tag
    needs: [preflight, merge]
    if: ${{ always() && needs.preflight.result == 'success' && (needs.merge.result == 'success' || inputs.release_tag != '') }}
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: write
      id-token: write
    outputs:
      tag: ${{ steps.validate.outputs.tag }}
      latest: ${{ steps.validate.outputs.latest }}
    env:
      GH_TOKEN: ${{ github.token }}
      RELEASE_TAG: ${{ needs.merge.outputs.tag || inputs.release_tag }}
      NPM_CONFIG_PROVENANCE: "true"
    steps:
      - name: Validate tag input
        run: |
          if [[ ! "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "An existing stable release tag is required." >&2
            exit 1
          fi
      - uses: actions/checkout@v7
        with:
          ref: ${{ env.RELEASE_TAG }}
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-node@v7
        with:
          node-version: 24
          package-manager-cache: false
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.1
      - run: bun install --frozen-lockfile
      - name: Validate release and publication channel
        id: validate
        run: node scripts/validate-release.ts
      - name: Test release preflight
        run: |
          bun run test:release
          bun run typecheck:release
      - name: Assemble announcement, changelog and contributors
        run: node scripts/generate-release-notes.ts "${RELEASE_TAG#v}" "$RUNNER_TEMP/release-notes.md"
      - name: Publish packages with trusted publishing
        # Both packages keep their existing trusted publisher for release.yml.
        run: node scripts/publish-release.ts "${RELEASE_TAG#v}"
        env:
          NPM_CONFIG_CACHE: ${{ runner.temp }}/npm-cache
      - uses: actions/upload-artifact@v7
        with:
          name: release-notes
          path: ${{ runner.temp }}/release-notes.md

  build-android:
    needs: publish
    permissions:
      contents: write
    uses: ./.github/workflows/build-android-release.yml
    with:
      tag: ${{ needs.publish.outputs.tag }}

  announce:
    name: Publish GitHub release with notes and APK
    needs: [publish, build-android]
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@v8
        with:
          name: release-notes
      - name: Publish draft release
        env:
          GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.RELEASE_IT_GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          RELEASE_TAG: ${{ needs.publish.outputs.tag }}
          RELEASE_LATEST: ${{ needs.publish.outputs.latest }}
        run: |
          gh release edit "$RELEASE_TAG" --draft=false --title "NitroSQLite ${RELEASE_TAG#v}" --latest="$RELEASE_LATEST" --notes-file release-notes.md