prepare-release.yml

name: Prepare Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Release version (e.g., 29.0.4)'
        required: true
        type: string
      previous_version:
        description: 'Previous version for changelog (e.g., 29.0.3). Leave empty to auto-detect.'
        required: false
        type: string
      drawio_ref:
        description: 'Public drawio submodule ref (tag, branch, or commit). Leave empty to keep the current submodule pin — useful when the public repo has not yet tagged this release.'
        required: false
        type: string
      dry_run:
        description: 'Dry run - validate only, do not commit'
        required: false
        type: boolean
        default: false
      override_audit:
        description: 'Proceed even if npm audit finds critical/high vulnerabilities in runtime dependencies. Only for reviewed, accepted advisories - the override is recorded in the release PR.'
        required: false
        type: boolean
        default: false

env:
  NODE_VERSION: '24'

jobs:
  prepare-release:
    runs-on: ubuntu-latest
    
    permissions:
      contents: write
      pull-requests: write
      
    steps:
      - name: Validate version format
        run: |
          if ! [[ "${{ inputs.version }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "::error::Version must be in format X.Y.Z (e.g., 29.0.4)"
            exit 1
          fi
          echo "VERSION=${{ inputs.version }}" >> $GITHUB_ENV
          
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          submodules: recursive
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}
          
      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          check-latest: true
          
      - name: Log versions
        run: |
          echo "Node version: $(node --version)"
          echo "npm version: $(npm --version)"
          
      - name: Determine drawio ref
        run: |
          if [ -n "${{ inputs.drawio_ref }}" ]; then
            echo "DRAWIO_REF=${{ inputs.drawio_ref }}" >> $GITHUB_ENV
            echo "DRAWIO_UPDATE=true" >> $GITHUB_ENV
            echo "DRAWIO_SUMMARY=updated to ${{ inputs.drawio_ref }}" >> $GITHUB_ENV
          else
            # No ref supplied: keep the submodule at its current pin. CI builds
            # source the editor from drawio-dev's release branch anyway, so the
            # public submodule only needs to track whatever public commit is
            # appropriate for out-of-tree builders — which may lag this release.
            echo "DRAWIO_REF=" >> $GITHUB_ENV
            echo "DRAWIO_UPDATE=false" >> $GITHUB_ENV
            echo "DRAWIO_SUMMARY=unchanged (no drawio_ref supplied; CI builds from drawio-dev)" >> $GITHUB_ENV
          fi

      - name: Update drawio submodule
        if: env.DRAWIO_UPDATE == 'true'
        run: |
          cd drawio
          git fetch origin --tags

          # Check if ref exists
          if ! git rev-parse --verify "${{ env.DRAWIO_REF }}" >/dev/null 2>&1; then
            echo "::error::Ref '${{ env.DRAWIO_REF }}' not found in drawio repository"
            exit 1
          fi

          git checkout "${{ env.DRAWIO_REF }}"

          # Update any nested submodules in drawio
          git submodule update --init --recursive

          echo "DRAWIO_COMMIT=$(git rev-parse HEAD)" >> $GITHUB_ENV
          echo "Updated drawio to: $(git describe --tags --always)"
          cd ..

      - name: Record current drawio submodule pin
        if: env.DRAWIO_UPDATE != 'true'
        run: |
          cd drawio
          echo "DRAWIO_COMMIT=$(git rev-parse HEAD)" >> $GITHUB_ENV
          echo "drawio submodule left at: $(git describe --tags --always)"
          cd ..
          
      - name: Update package.json version
        run: |
          # Update version in package.json
          jq '.version = "${{ env.VERSION }}"' package.json > package.json.tmp
          mv package.json.tmp package.json
          
          echo "Updated package.json to version ${{ env.VERSION }}"
          grep '"version"' package.json
          
      - name: Install dependencies
        run: |
          # Clean install from scratch to ensure package-lock.json has all resolved URLs and integrity hashes.
          # Without this, entries carried over from a previous node_modules lack these fields,
          # which breaks offline/sandboxed builds like Flatpak (see #2301).
          rm -rf node_modules package-lock.json
          npm install

      - name: Generate release notes
        run: |
          VERSION="${{ env.VERSION }}"
          PREV_VERSION="${{ inputs.previous_version }}"
          
          # Auto-detect previous version if not provided
          if [ -z "$PREV_VERSION" ]; then
            PREV_VERSION=$(git describe --tags --abbrev=0 2>/dev/null | sed 's/^v//' || echo "")
          fi
          
          # Get electron version from package-lock.json (actual installed version)
          ELECTRON_VERSION=$(jq -r '.packages["node_modules/electron"].version' package-lock.json)
          echo "ELECTRON_VERSION=$ELECTRON_VERSION" >> $GITHUB_ENV
          
          # Build the previous-version trailer once so it can be appended to
          # the ChangeLog line regardless of which variant we emit.
          if [ -n "$PREV_VERSION" ]; then
            PREV_TEXT=" All changes from ${PREV_VERSION} to ${VERSION} are added in this build."
          else
            PREV_TEXT=""
          fi

          # Check whether the public drawio repo has tagged this version yet.
          # The internal drawio-dev can be ahead, in which case a ChangeLog link
          # to jgraph/drawio/blob/v{VERSION}/ChangeLog would 404. We probe the
          # tag via the unauthenticated GitHub API and swap in a plain note when
          # the tag is not yet published.
          PUBLIC_TAG_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
            "https://api.github.com/repos/jgraph/drawio/git/refs/tags/v${VERSION}")
          if [ "$PUBLIC_TAG_STATUS" = "200" ]; then
            CHANGELOG_LINE="- Updates to [draw.io core ${VERSION}](https://github.com/jgraph/drawio/blob/v${VERSION}/ChangeLog).${PREV_TEXT}"
            echo "Public drawio tag v${VERSION} exists — including ChangeLog link."
          else
            CHANGELOG_LINE="- Built from the drawio-dev release branch. The public drawio tag v${VERSION} is not yet available; the ChangeLog will be at https://github.com/jgraph/drawio/blob/v${VERSION}/ChangeLog once the public tag is pushed.${PREV_TEXT}"
            echo "Public drawio tag v${VERSION} not yet available (HTTP ${PUBLIC_TAG_STATUS}) — emitting deferred-link note."
          fi

          # Generate release notes. We use a variable-expanding heredoc (no
          # quotes around RELEASE_EOF) so ${VERSION}, ${ELECTRON_VERSION}, and
          # ${CHANGELOG_LINE} are substituted in place — no post-hoc sed pass
          # that could mis-escape URL or markdown characters.
          cat > release-notes.md << RELEASE_EOF
          ## Release Notes for ${VERSION}

          [Windows Installer](https://github.com/jgraph/drawio-desktop/releases/download/v${VERSION}/draw.io-${VERSION}-windows-installer.exe)
          [Windows No Installer (zip)](https://github.com/jgraph/drawio-desktop/releases/download/v${VERSION}/draw.io-${VERSION}-windows.zip)
          [macOS - Universal](https://github.com/jgraph/drawio-desktop/releases/download/v${VERSION}/draw.io-universal-${VERSION}.dmg)
          Linux - [deb](https://github.com/jgraph/drawio-desktop/releases/download/v${VERSION}/drawio-amd64-${VERSION}.deb), [AppImage](https://github.com/jgraph/drawio-desktop/releases/download/v${VERSION}/drawio-x86_64-${VERSION}.AppImage) or [rpm](https://github.com/jgraph/drawio-desktop/releases/download/v${VERSION}/drawio-x86_64-${VERSION}.rpm)
          Windows intel x32 releases are marked -ia32-

          **ChangeLog:**
          - Uses electron ${ELECTRON_VERSION}.
          ${CHANGELOG_LINE}
          RELEASE_EOF
          
          echo "## Generated Release Notes" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          cat release-notes.md >> $GITHUB_STEP_SUMMARY
          
          echo "Release notes generated with Electron version: $ELECTRON_VERSION"
        
      - name: Security audit
        id: audit
        continue-on-error: true
        run: |
          echo "## npm audit results" >> $GITHUB_STEP_SUMMARY
          
          # Full audit (all deps) for the report; runtime-only audit for the gate.
          # Build tooling (electron-builder tree) never ships in the app, so its
          # advisories are reported but do not block the release.
          npm audit --json > audit-results.json 2>&1 || true
          npm audit --omit=dev --json > audit-prod.json 2>&1 || true

          # Parse results
          CRITICAL=$(jq '.metadata.vulnerabilities.critical // 0' audit-results.json)
          HIGH=$(jq '.metadata.vulnerabilities.high // 0' audit-results.json)
          MODERATE=$(jq '.metadata.vulnerabilities.moderate // 0' audit-results.json)
          LOW=$(jq '.metadata.vulnerabilities.low // 0' audit-results.json)
          PROD_CRITICAL=$(jq '.metadata.vulnerabilities.critical // 0' audit-prod.json)
          PROD_HIGH=$(jq '.metadata.vulnerabilities.high // 0' audit-prod.json)

          echo "| Severity | Runtime deps | All deps |" >> $GITHUB_STEP_SUMMARY
          echo "|----------|--------------|----------|" >> $GITHUB_STEP_SUMMARY
          echo "| Critical | $PROD_CRITICAL | $CRITICAL |" >> $GITHUB_STEP_SUMMARY
          echo "| High | $PROD_HIGH | $HIGH |" >> $GITHUB_STEP_SUMMARY
          echo "| Moderate | - | $MODERATE |" >> $GITHUB_STEP_SUMMARY
          echo "| Low | - | $LOW |" >> $GITHUB_STEP_SUMMARY

          # Save for artifact
          npm audit > audit-report.txt 2>&1 || true

          # Fail if critical or high vulnerabilities in runtime dependencies
          if [ "$PROD_CRITICAL" -gt 0 ] || [ "$PROD_HIGH" -gt 0 ]; then
            if [ "${{ inputs.override_audit }}" = "true" ]; then
              echo "::warning::Audit override: proceeding despite $PROD_CRITICAL critical, $PROD_HIGH high in runtime dependencies"
              echo "AUDIT_FAILED=false" >> $GITHUB_ENV
              echo "AUDIT_LINE=:warning: OVERRIDDEN: $PROD_CRITICAL critical, $PROD_HIGH high in runtime dependencies (override_audit=true)" >> $GITHUB_ENV
            else
              echo "::error::Security vulnerabilities found in runtime dependencies: $PROD_CRITICAL critical, $PROD_HIGH high"
              echo "AUDIT_FAILED=true" >> $GITHUB_ENV
              echo "AUDIT_LINE=:x: $PROD_CRITICAL critical, $PROD_HIGH high in runtime dependencies" >> $GITHUB_ENV
            fi
          else
            echo "AUDIT_FAILED=false" >> $GITHUB_ENV
            if [ "$CRITICAL" -gt 0 ] || [ "$HIGH" -gt 0 ]; then
              echo "AUDIT_LINE=:white_check_mark: Runtime dependencies clean ($CRITICAL critical, $HIGH high in build tooling only, non-blocking - see audit artifact)" >> $GITHUB_ENV
            else
              echo "AUDIT_LINE=:white_check_mark: No critical/high vulnerabilities" >> $GITHUB_ENV
            fi
          fi
          
      - name: Check outdated dependencies
        run: |
          echo "## Outdated dependencies" >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          npm outdated >> $GITHUB_STEP_SUMMARY 2>&1 || true
          echo '```' >> $GITHUB_STEP_SUMMARY
          
          npm outdated > outdated-report.txt 2>&1 || true
          
      - name: Upload audit artifacts
        uses: actions/upload-artifact@v7
        with:
          name: release-evidence-v${{ env.VERSION }}
          path: |
            audit-results.json
            audit-prod.json
            audit-report.txt
            outdated-report.txt
            release-notes.md
          retention-days: 365
          
      - name: Fail if audit has issues
        if: env.AUDIT_FAILED == 'true'
        run: |
          echo "::error::Cannot proceed with release due to security vulnerabilities in runtime dependencies"
          echo "Review audit-report.txt and fix vulnerabilities before releasing."
          echo "If the advisories have been reviewed and accepted, re-run with override_audit=true (recorded in the release PR)."
          exit 1
          
      - name: Generate release summary
        run: |
          echo "## Release Preparation Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Item | Value |" >> $GITHUB_STEP_SUMMARY
          echo "|------|-------|" >> $GITHUB_STEP_SUMMARY
          echo "| Version | ${{ env.VERSION }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Electron | ${{ env.ELECTRON_VERSION }} |" >> $GITHUB_STEP_SUMMARY
          echo "| drawio submodule | ${{ env.DRAWIO_SUMMARY }} |" >> $GITHUB_STEP_SUMMARY
          echo "| drawio commit | ${{ env.DRAWIO_COMMIT }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Node.js | $(node --version) |" >> $GITHUB_STEP_SUMMARY
          echo "| npm | $(npm --version) |" >> $GITHUB_STEP_SUMMARY
          echo "| Dry run | ${{ inputs.dry_run }} |" >> $GITHUB_STEP_SUMMARY
          
      - name: Commit changes
        if: inputs.dry_run == false
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          
          # Save release notes content before cleanup
          cp release-notes.md /tmp/release-notes.md
          
          # Create release branch
          git checkout -b "releases/v${{ env.VERSION }}"
          
          # Remove generated files that shouldn't be committed
          # (package-lock.json IS committed to lock electron version)
          rm -f audit-results.json audit-prod.json audit-report.txt outdated-report.txt release-notes.md
          
          git add -A
          git commit -m "Prepare release v${{ env.VERSION }}

          - drawio submodule: ${{ env.DRAWIO_SUMMARY }} (${{ env.DRAWIO_COMMIT }})
          - Updated package.json version to ${{ env.VERSION }}
          - Updated package-lock.json
          - Electron version: ${{ env.ELECTRON_VERSION }}

          Automated by prepare-release workflow"
          
          git push origin "releases/v${{ env.VERSION }}"
          
          # Restore release notes for PR creation
          cp /tmp/release-notes.md release-notes.md
          
      - name: Create Pull Request
        if: inputs.dry_run == false
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Get the release notes content
          RELEASE_NOTES=$(cat release-notes.md)
          
          # Create PR
          PR_URL=$(gh pr create \
            --base dev \
            --head "releases/v${{ env.VERSION }}" \
            --title "Release v${{ env.VERSION }}" \
            --body "## Release Preparation

          This PR prepares release v${{ env.VERSION }}.

          ### Changes
          - drawio submodule: ${{ env.DRAWIO_SUMMARY }}
          - Updated package.json version to ${{ env.VERSION }}
          - Electron version: ${{ env.ELECTRON_VERSION }}

          ### Audit Results
          - npm audit: ${{ env.AUDIT_LINE }}

          ### After Merging
          Create and push the tag to trigger builds:
          \`\`\`bash
          git checkout dev
          git pull
          git tag -a v${{ env.VERSION }} -m \"Release v${{ env.VERSION }}\"
          git push origin v${{ env.VERSION }}
          \`\`\`

          ---

          ${RELEASE_NOTES}
          ")
          
          echo "## Pull Request Created" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "PR: ${PR_URL}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Next Steps" >> $GITHUB_STEP_SUMMARY
          echo "1. Review and merge the PR" >> $GITHUB_STEP_SUMMARY
          echo "2. Create the tag: \`git tag -a v${{ env.VERSION }} -m \"Release v${{ env.VERSION }}\"\`" >> $GITHUB_STEP_SUMMARY
          echo "3. Push the tag: \`git push origin v${{ env.VERSION }}\`" >> $GITHUB_STEP_SUMMARY
          
      - name: Summary
        run: |
          if [ "${{ inputs.dry_run }}" = "true" ]; then
            echo "::notice::Dry run complete. No changes committed."
          else
            echo "::notice::Release PR created for v${{ env.VERSION }}. Review, merge, then create tag to trigger builds."
          fi