release-please.yml

name: Release

# Automated semantic versioning driven purely by Conventional Commits.
#
# On every push to main, release-please reconciles the commit history against
# `.release-please-manifest.json` and maintains a single "chore(main): release
# x.y.z" pull request. Merging that PR is the release: release-please then
# writes CHANGELOG.md, bumps package.json + package-lock.json, tags `vX.Y.Z`
# and publishes the GitHub Release.
#
# Version anchor: the repository was tagged v1.0.0 at the submission state, and
# the manifest records that same 1.0.0 as the last released version. From here
# `fix:` -> 1.0.1, `feat:` -> 1.1.0, `feat!:`/`BREAKING CHANGE:` -> 2.0.0.
#
# Auth is the built-in GITHUB_TOKEN — no PAT, no external secret.
#
# GOTCHA — release-please-config.json must keep `"package-name": ""`.
#
# With separate-pull-requests: false the Merge plugin flattens the single
# package into one PR on branch `release-please--branches--main`, which carries
# NO component. When it later builds the GitHub Release it compares that branch
# against getBranchComponent() = `component || normalizeComponent(packageName)`.
# A scoped name (@overrule/core) normalises to "core", so the check fails with
# "PR component: undefined does not match configured component: core" and the
# release is silently skipped — the job still reports success while nothing
# ships. `"component": ""` does NOT help: it is falsy, so it falls through to
# the package name. Only an empty package-name makes both sides resolve to "".
# Verified with: npx release-please@17 github-release --dry-run (0 vs 1 tagged).

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write
  issues: write

# Never run two release reconciliations at once, and never cancel one midway:
# a half-finished release PR is worse than a queued one.
concurrency:
  group: release-please-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release-please:
    name: "Release PR / tag / GitHub Release"
    runs-on: ubuntu-latest
    outputs:
      released: ${{ steps.release.outputs.release_created || steps.retry.outputs.release_created }}
      tag: ${{ steps.release.outputs.tag_name || steps.retry.outputs.tag_name }}
      version: ${{ steps.release.outputs.version || steps.retry.outputs.version }}
    steps:
      - name: Run release-please
        id: release
        # GitHub's git-data endpoints (POST /git/refs, POST /git/commits) 503
        # intermittently, which kills release-please mid-flight through no
        # fault of the config. Absorb the first failure and retry below.
        continue-on-error: true
        uses: googleapis/release-please-action@v4
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json

      - name: Back off before retrying
        if: steps.release.outcome == 'failure'
        run: |
          echo "release-please failed (likely a transient GitHub API 5xx) — retrying in 45s"
          sleep 45

      # release-please is idempotent: it reconciles the existing release branch
      # and PR rather than duplicating them, so a second pass is safe. This one
      # is NOT continue-on-error — if the API is genuinely down, the job goes red.
      - name: Run release-please (retry)
        id: retry
        if: steps.release.outcome == 'failure'
        uses: googleapis/release-please-action@v4
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json

      # Outputs are passed through `env`, never interpolated into the script:
      # `outputs.pr` is a raw JSON blob containing quotes, newlines and `<`,
      # which breaks (and could inject into) an inlined shell command.
      - name: Report outcome
        if: always()
        env:
          RELEASED: ${{ steps.release.outputs.release_created || steps.retry.outputs.release_created }}
          TAG_NAME: ${{ steps.release.outputs.tag_name || steps.retry.outputs.tag_name }}
          VERSION: ${{ steps.release.outputs.version || steps.retry.outputs.version }}
          PRS_CREATED: ${{ steps.release.outputs.prs_created || steps.retry.outputs.prs_created }}
          PR_JSON: ${{ steps.release.outputs.pr || steps.retry.outputs.pr }}
        run: |
          set -euo pipefail
          if [ "${RELEASED:-}" = "true" ]; then
            {
              echo "### Released ${TAG_NAME:-}"
              echo ""
              echo "- tag: \`${TAG_NAME:-}\`"
              echo "- version: \`${VERSION:-}\`"
            } >> "$GITHUB_STEP_SUMMARY"
          elif [ -n "${PR_JSON:-}" ]; then
            num=$(printf '%s' "$PR_JSON" | jq -r '.number // empty' 2>/dev/null || true)
            {
              echo "### Release PR ${num:+#$num} is open (prs_created=${PRS_CREATED:-false})"
              echo ""
              echo "Merge it to tag the version, write CHANGELOG.md and publish the GitHub Release."
            } >> "$GITHUB_STEP_SUMMARY"
          else
            echo "No release-worthy commits since the last release." >> "$GITHUB_STEP_SUMMARY"
          fi