release-please.yml

name: Release Please

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write
  actions: write
  checks: read

jobs:
  release-please:
    runs-on: ubuntu-latest
    outputs:
      release_created: ${{ steps.rp.outputs.release_created }}
      tag_name: ${{ steps.rp.outputs.tag_name }}
      pr_number: ${{ steps.rp.outputs.pr }}
    steps:
      - id: rp
        uses: googleapis/release-please-action@v5
        with:
          config-file: .release-please-config.json
          manifest-file: .release-please-manifest.json

      - name: Validate and merge release PR
        if: ${{ steps.rp.outputs.pr }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail

          PR_NUMBER=$(jq -r '.number' <<< '${{ steps.rp.outputs.pr }}')
          PR_JSON=$(gh pr view "$PR_NUMBER" \
            --repo "${{ github.repository }}" \
            --json headRefName,headRefOid)
          HEAD_REF=$(jq -r '.headRefName' <<< "$PR_JSON")
          HEAD_SHA=$(jq -r '.headRefOid' <<< "$PR_JSON")

          echo "Dispatching PR build for release PR #$PR_NUMBER at $HEAD_REF ($HEAD_SHA)"
          gh workflow run pullrequest.yml \
            --repo "${{ github.repository }}" \
            --ref "$HEAD_REF"

          RUN_ID=""
          for _ in $(seq 1 60); do
            RUN_ID=$(gh run list \
              --repo "${{ github.repository }}" \
              --workflow pullrequest.yml \
              --branch "$HEAD_REF" \
              --event workflow_dispatch \
              --json databaseId,headSha \
              --jq "map(select(.headSha == \"$HEAD_SHA\")) | .[0].databaseId // \"\"")
            if [ -n "$RUN_ID" ]; then
              break
            fi
            sleep 5
          done

          if [ -z "$RUN_ID" ]; then
            echo "::error::Timed out waiting for dispatched PR build to appear"
            exit 1
          fi

          echo "Waiting for PR build run $RUN_ID"
          STATUS=""
          CONCLUSION=""
          RUN_URL=""
          for _ in $(seq 1 180); do
            RUN_JSON=$(gh run view "$RUN_ID" \
              --repo "${{ github.repository }}" \
              --json status,conclusion,url)
            STATUS=$(jq -r '.status' <<< "$RUN_JSON")
            CONCLUSION=$(jq -r '.conclusion // ""' <<< "$RUN_JSON")
            RUN_URL=$(jq -r '.url' <<< "$RUN_JSON")
            if [ "$STATUS" = "completed" ]; then
              break
            fi
            sleep 10
          done

          if [ "$STATUS" != "completed" ]; then
            echo "::error::Timed out waiting for PR build run $RUN_ID"
            exit 1
          fi

          CHECKS_JSON=$(gh api \
            "repos/${{ github.repository }}/commits/$HEAD_SHA/check-runs?per_page=100")
          RUN_CHECKS=$(jq --arg run_url "$RUN_URL" '
            [
              .check_runs[]
              | select((.details_url // "") | startswith($run_url + "/job/"))
            ]
          ' <<< "$CHECKS_JSON")
          CHECK_COUNT=$(jq 'length' <<< "$RUN_CHECKS")
          if [ "$CHECK_COUNT" -eq 0 ]; then
            echo "::error::No native checks from run $RUN_ID found on commit $HEAD_SHA"
            exit 1
          fi

          echo "Native checks for run $RUN_ID on commit $HEAD_SHA:"
          jq -r '.[] | "\(.name): \(.status) / \(.conclusion // "none")"' \
            <<< "$RUN_CHECKS"
          BAD_CHECKS=$(jq '
            [
              .[]
              | select(.status != "completed" or .conclusion != "success")
            ]
          ' <<< "$RUN_CHECKS")
          if [ "$(jq 'length' <<< "$BAD_CHECKS")" -ne 0 ]; then
            echo "::error::Dispatched run has incomplete or unsuccessful native checks"
            jq -c '.[] | {name, status, conclusion, details_url}' <<< "$BAD_CHECKS"
            exit 1
          fi

          if [ "$CONCLUSION" != "success" ]; then
            echo "::error::Release PR build concluded $CONCLUSION"
            exit 1
          fi

          CURRENT_HEAD_SHA=$(gh pr view "$PR_NUMBER" \
            --repo "${{ github.repository }}" \
            --json headRefOid \
            --jq '.headRefOid')
          if [ "$CURRENT_HEAD_SHA" != "$HEAD_SHA" ]; then
            echo "::error::Release PR moved from $HEAD_SHA to $CURRENT_HEAD_SHA during validation"
            exit 1
          fi

          echo "Merging release PR #$PR_NUMBER"
          for _ in $(seq 1 30); do
            if gh pr merge "$PR_NUMBER" \
              --repo "${{ github.repository }}" \
              --match-head-commit "$HEAD_SHA" \
              --merge; then
              break
            fi
            PR_STATE_JSON=$(gh pr view "$PR_NUMBER" \
              --repo "${{ github.repository }}" \
              --json state,headRefOid)
            STATE=$(jq -r '.state' <<< "$PR_STATE_JSON")
            if [ "$STATE" = "MERGED" ]; then
              CURRENT_HEAD_SHA=$(jq -r '.headRefOid' <<< "$PR_STATE_JSON")
              if [ "$CURRENT_HEAD_SHA" != "$HEAD_SHA" ]; then
                echo "::error::Release PR #$PR_NUMBER merged at unvalidated head $CURRENT_HEAD_SHA"
                exit 1
              fi
              break
            fi
            sleep 10
          done

          PR_STATE_JSON=$(gh pr view "$PR_NUMBER" \
            --repo "${{ github.repository }}" \
            --json state,headRefOid)
          STATE=$(jq -r '.state' <<< "$PR_STATE_JSON")
          CURRENT_HEAD_SHA=$(jq -r '.headRefOid' <<< "$PR_STATE_JSON")
          if [ "$STATE" != "MERGED" ] || [ "$CURRENT_HEAD_SHA" != "$HEAD_SHA" ]; then
            echo "::error::Release PR #$PR_NUMBER did not merge"
            exit 1
          fi

          gh workflow run release-please.yml \
            --repo "${{ github.repository }}" \
            --ref "${{ github.ref_name }}"

  trigger-release:
    needs: release-please
    if: needs.release-please.outputs.release_created == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Dispatch release.yml on the new tag
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh workflow run release.yml \
            --repo "${{ github.repository }}" \
            --ref "${{ needs.release-please.outputs.tag_name }}" \
            -f release_tag="${{ needs.release-please.outputs.tag_name }}"