release.yml

name: Release

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: Existing release tag to recover
        required: true
        type: string
      publish:
        description: Publish after the trusted publishing preflight passes
        required: true
        default: false
        type: boolean
      move-major-tag:
        description: Move v1 after publishing a stable release
        required: true
        default: false
        type: boolean

permissions:
  contents: read

jobs:
  resolve-release:
    name: Resolve release
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      prerelease: ${{ steps.release.outputs.prerelease }}
      sha: ${{ steps.release.outputs.sha }}
      tag: ${{ steps.release.outputs.tag }}

    steps:
      - name: Resolve release
        id: release
        shell: bash
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ github.event.release.tag_name || inputs.tag }}
        run: |
          set -euo pipefail
          if ! [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
            echo "Release tag must be a semantic version prefixed with v" >&2
            exit 1
          fi

          release_data="$(gh api "repos/$GITHUB_REPOSITORY/releases/tags/$RELEASE_TAG" --jq '[.draft, .prerelease, .published_at] | @tsv')"
          IFS=$'\t' read -r draft prerelease published_at <<< "$release_data"

          if [ "$draft" != "false" ] || [ -z "$published_at" ] || [ "$published_at" = "null" ]; then
            echo "Release tag must belong to a published GitHub Release" >&2
            exit 1
          fi

          ref_data="$(gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$RELEASE_TAG" --jq '[.object.type, .object.sha] | @tsv')"
          IFS=$'\t' read -r object_type object_sha <<< "$ref_data"

          if [ "$object_type" = "tag" ]; then
            tag_data="$(gh api "repos/$GITHUB_REPOSITORY/git/tags/$object_sha" --jq '[.object.type, .object.sha] | @tsv')"
            IFS=$'\t' read -r object_type object_sha <<< "$tag_data"
          fi

          if [ "$object_type" != "commit" ]; then
            echo "Release tag does not resolve to a commit" >&2
            exit 1
          fi

          compare_status="$(gh api "repos/$GITHUB_REPOSITORY/compare/$object_sha...$DEFAULT_BRANCH" --jq '.status')"
          if [ "$compare_status" != "ahead" ] && [ "$compare_status" != "identical" ]; then
            echo "Release commit must be reachable from the default branch" >&2
            exit 1
          fi

          {
            echo "prerelease=$prerelease"
            echo "sha=$object_sha"
            echo "tag=$RELEASE_TAG"
          } >> "$GITHUB_OUTPUT"

  publish-npm:
    name: Publish to npm
    runs-on: ubuntu-latest
    needs: resolve-release
    permissions:
      contents: read
      id-token: write

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.resolve-release.outputs.sha }}

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.0

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          package-manager-cache: false
          registry-url: https://registry.npmjs.org

      - name: Install npm 12
        run: npm install --global npm@12.0.1

      - name: Verify release tag
        env:
          RELEASE_TAG: ${{ needs.resolve-release.outputs.tag }}
        run: |
          expected_tag="v$(node -p 'require("./package.json").version')"
          if [ "$RELEASE_TAG" != "$expected_tag" ]; then
            echo "Release tag $RELEASE_TAG does not match package version $expected_tag" >&2
            exit 1
          fi

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Typecheck
        run: pnpm typecheck

      - name: Build
        run: pnpm build

      - name: Test
        run: pnpm vitest run

      - name: Self-scan
        run: node dist/cli.js scan . --json
        env:
          AISLOP_NO_HISTORY: "1"
          AISLOP_NO_TELEMETRY: "1"
          AISLOP_NO_UPDATE_NOTIFIER: "1"
          DO_NOT_TRACK: "1"

      - name: Verify npm trusted publishing
        shell: bash
        run: |
          set -euo pipefail
          log_file="$(mktemp)"
          trap 'rm -f "$log_file"' EXIT
          npm publish --access public --dry-run --loglevel verbose 2>&1 | tee "$log_file"
          if ! grep -Fq "Successfully retrieved and set token" "$log_file"; then
            echo "npm trusted publishing token exchange failed" >&2
            exit 1
          fi

      - name: Publish to npm
        if: ${{ github.event_name == 'release' }}
        run: npm publish --access public

      - name: Publish recovery to npm
        if: >-
          ${{
            github.event_name == 'workflow_dispatch' &&
            github.ref == format('refs/heads/{0}', github.event.repository.default_branch) &&
            inputs.publish
          }}
        run: npm publish --access public
        env:
          NPM_CONFIG_PROVENANCE: "false"

  publish-gpr:
    name: Publish to GitHub Packages
    runs-on: ubuntu-latest
    needs: [resolve-release, publish-npm]
    if: >-
      ${{
        github.event_name == 'release' ||
        (github.event_name == 'workflow_dispatch' &&
          github.ref == format('refs/heads/{0}', github.event.repository.default_branch) &&
          inputs.publish)
      }}
    permissions:
      contents: read
      packages: write

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.resolve-release.outputs.sha }}

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.0

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          package-manager-cache: false
          registry-url: https://npm.pkg.github.com
          scope: '@scanaislop'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build
        run: pnpm build

      - name: Set scoped package name
        run: npm pkg set name="@scanaislop/aislop"

      - name: Publish to GitHub Packages
        run: npm publish --access public --registry=https://npm.pkg.github.com
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  move-major-tag:
    name: Move v1 Action tag to this release
    runs-on: ubuntu-latest
    needs: [resolve-release, publish-npm]
    if: >-
      ${{
        (github.event_name == 'release' &&
          needs.resolve-release.outputs.prerelease == 'false') ||
        (github.event_name == 'workflow_dispatch' &&
          github.ref == format('refs/heads/{0}', github.event.repository.default_branch) &&
          inputs.publish &&
          inputs['move-major-tag'] &&
          needs.resolve-release.outputs.prerelease == 'false')
      }}
    permissions:
      contents: read

    steps:
      - name: Re-point v1 to ${{ needs.resolve-release.outputs.tag }}
        env:
          GH_TOKEN: ${{ secrets.SYNC_BOT_PAT }}
          RELEASE_SHA: ${{ needs.resolve-release.outputs.sha }}
        run: |
          gh api \
            --method PATCH \
            "repos/$GITHUB_REPOSITORY/git/refs/tags/v1" \
            --field "sha=$RELEASE_SHA" \
            --field force=true