release.yml

name: Release

# Cut a release by pushing a version tag:
#
#   npm version patch          # or minor / major — bumps package.json + manifest, commits, tags
#   git push --follow-tags     # pushes the commit AND the v* tag
#
# The tag push triggers this workflow, which re-runs the full check suite, builds
# the Claude Desktop `.mcpb` bundle, publishes a GitHub Release with the bundle
# attached + auto-generated notes, and pushes a Docker image to ghcr.io.
# npm publishing stays manual by default; set repository variable
# ABLETON_MIND_AUTO_NPM_PUBLISH=true and NPM_TOKEN to opt in. Prerelease tags
# containing "-" are always skipped.

on:
  push:
    tags:
      - "v*"

# Least privilege by default; the job below elevates only what it needs.
permissions:
  contents: read

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    name: Build + publish + DXT + Docker
    runs-on: ubuntu-latest
    permissions:
      contents: write   # create the GitHub Release + upload the .mcpb asset
      packages: write   # push to ghcr.io
      id-token: write   # npm publish provenance, used only when explicitly enabled
    steps:
      - uses: actions/checkout@v6

      - name: Use Node.js 20
        uses: actions/setup-node@v6
        with:
          node-version: 20.x
          cache: npm
          registry-url: "https://registry.npmjs.org"

      - name: Use Python 3.11
        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55
        with:
          python-version: "3.11"

      - name: Verify tag matches package.json and manifest versions
        run: |
          TAG="${GITHUB_REF_NAME#v}"
          PKG="$(node -p "require('./package.json').version")"
          MANIFEST="$(node -p "require('./dxt/manifest.json').version")"
          SERVER="$(node -p "require('./server.json').version")"
          SERVER_PKG="$(node -p "require('./server.json').packages[0].version")"
          SAFESKILL="$(node -p "require('./safeskill.manifest.json').version")"
          echo "tag=$TAG  package.json=$PKG  manifest=$MANIFEST  server.json=$SERVER  server package=$SERVER_PKG  safeskill=$SAFESKILL"
          if [ "$TAG" != "$PKG" ]; then
            echo "::error::Tag v$TAG does not match package.json version $PKG. Bump with 'npm version' before tagging."
            exit 1
          fi
          if [ "$MANIFEST" != "$PKG" ]; then
            echo "::error::dxt/manifest.json version $MANIFEST does not match package.json $PKG (the 'version' npm script keeps them in sync)."
            exit 1
          fi
          if [ "$SERVER" != "$PKG" ]; then
            echo "::error::server.json version $SERVER does not match package.json $PKG."
            exit 1
          fi
          if [ "$SERVER_PKG" != "$PKG" ]; then
            echo "::error::server.json package version $SERVER_PKG does not match package.json $PKG."
            exit 1
          fi
          if [ "$SAFESKILL" != "$PKG" ]; then
            echo "::error::safeskill.manifest.json version $SAFESKILL does not match package.json $PKG."
            exit 1
          fi

      - name: Install dependencies
        run: npm ci

      - name: Typecheck
        run: npm run typecheck

      - name: Lint
        run: npm run lint

      - name: Test
        run: npm test

      - name: Bridge tests
        run: npm run test:bridge

      - name: Docs build
        run: npm run docs:build

      - name: Runtime dependency audit
        run: npm audit --omit=dev

      - name: Build
        run: npm run build

      - name: Pack dry run
        run: npm pack --dry-run --json

      - name: Build .mcpb bundle
        run: npm run build:dxt

      - name: Validate MCPB manifest
        run: npx --yes @anthropic-ai/mcpb validate dxt/manifest.json

      - name: Publish GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # A release may already exist if it was published from the GitHub UI
          # (publishing there creates the tag, which triggers this workflow). In
          # that case just (re)attach the bundle; otherwise create the release.
          BUNDLE="$(ls build/*.mcpb 2>/dev/null | head -1)"
          if [ -z "$BUNDLE" ]; then
            echo "::error::No .mcpb bundle found under build/"
            exit 1
          fi
          if gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1; then
            gh release upload "$GITHUB_REF_NAME" "$BUNDLE" --clobber
          else
            gh release create "$GITHUB_REF_NAME" "$BUNDLE" \
              --title "$GITHUB_REF_NAME" \
              --generate-notes \
              --verify-tag \
              ${{ contains(github.ref_name, '-') && '--prerelease' || '' }}
          fi

      - name: Docker login (ghcr.io)
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Compute Docker tags
        id: docker_tags
        run: |
          OWNER_LC="$(printf '%s' "$GITHUB_REPOSITORY_OWNER" | tr '[:upper:]' '[:lower:]')"
          {
            echo "tags<<EOF"
            echo "ghcr.io/${OWNER_LC}/ableton-mind:${GITHUB_REF_NAME}"
            if [[ "$GITHUB_REF_NAME" != *-* ]]; then
              echo "ghcr.io/${OWNER_LC}/ableton-mind:latest"
            fi
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Docker build + push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.docker_tags.outputs.tags }}

      - name: Check npm publish mode
        id: npm_publish
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
          AUTO_NPM_PUBLISH: ${{ vars.ABLETON_MIND_AUTO_NPM_PUBLISH }}
        run: |
          # Pre-release tags (containing "-") are always skipped.
          if [[ "$GITHUB_REF_NAME" == *-* ]]; then
            echo "enabled=false" >> "$GITHUB_OUTPUT"
            echo "### npm publish skipped (prerelease tag)" >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi
          if [ "$AUTO_NPM_PUBLISH" = "true" ] && [ -n "$NPM_TOKEN" ]; then
            echo "enabled=true" >> "$GITHUB_OUTPUT"
          else
            echo "enabled=false" >> "$GITHUB_OUTPUT"
            {
              echo "### npm publish not run"
              echo ""
              if [ "$AUTO_NPM_PUBLISH" != "true" ]; then
                echo "Automatic npm publishing is disabled. Publish \`ableton-mind@${GITHUB_REF_NAME#v}\` manually after reviewing the GitHub release."
              else
                echo "\`NPM_TOKEN\` is not set. Publish \`ableton-mind@${GITHUB_REF_NAME#v}\` manually after reviewing the GitHub release."
              fi
            } >> "$GITHUB_STEP_SUMMARY"
          fi

      - name: Publish to npm
        if: steps.npm_publish.outputs.enabled == 'true'
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          npm publish --provenance --access public
          {
            echo "### ✅ Published to npm"
            echo ""
            echo "\`ableton-mind@${GITHUB_REF_NAME#v}\` is live on npm."
          } >> "$GITHUB_STEP_SUMMARY"