release.yml

name: Publish

on:
  workflow_dispatch:
  push:
    paths:
      - ".changeset/**"
      - "packages/**"
      - "agents-cli/**"
      - "agents-api/**"
    branches:
      - main
      - chat-to-edit

permissions:
  contents: write
  pull-requests: write
  issues: write
  packages: write
  id-token: write

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0

      - name: Install
        uses: ./.github/composite-actions/install

      - name: Setup npm for OIDC publishing
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: "22"
          registry-url: "https://registry.npmjs.org"

      - name: Ensure npm 11.5.1+ for OIDC support
        run: npm install -g npm@latest

      - name: Setup Turborepo cache
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: .turbo
          key: ${{ runner.os }}-turbo-${{ github.sha }}
          restore-keys: |
            ${{ runner.os }}-turbo-

      - name: Build packages
        run: pnpm build
        env:
          TURBO_TELEMETRY_DISABLED: 1
          TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
          TURBO_TEAM: ${{ vars.TURBO_TEAM }}

      # Generate a GitHub App token so that PRs and releases created by this
      # workflow trigger downstream CI workflows. The default GITHUB_TOKEN
      # cannot do this (GitHub security restriction).
      - name: Generate GitHub App Token
        id: app-token
        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
        with:
          app-id: ${{ secrets.INTERNAL_CI_APP_ID }}
          private-key: ${{ secrets.INTERNAL_CI_APP_PRIVATE_KEY }}

      - name: Publish packages
        id: changesets
        uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1
        with:
          publish: pnpm release
          createGithubReleases: false
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
          HUSKY: 0

      - name: Release to snapshot tag
        if: steps.changesets.outputs.published != 'true'
        run: |
          BRANCH_NAME="${GITHUB_REF#refs/heads/}"
          if [ "$BRANCH_NAME" = "chat-to-edit" ]; then
            TAG_NAME="chat-to-edit"
          else
            TAG_NAME="dev"
          fi
          echo "Publishing to tag: $TAG_NAME"
          git checkout $BRANCH_NAME
          pnpm changeset version --snapshot $TAG_NAME
          pnpm changeset publish --tag $TAG_NAME
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
          HUSKY: 0

      - name: Create GitHub Release
        if: steps.changesets.outputs.published == 'true'
        shell: bash
        run: |
          VERSION=$(echo '${{ steps.changesets.outputs.publishedPackages }}' | jq -r '.[0].version')
          RELEASE_DATE=$(date +%Y-%m-%d)

          # Get the most recently merged PR's body
          PR_BODY=$(gh pr list --state merged --base main --json body,mergedAt --jq 'sort_by(.mergedAt) | last | .body')

          # Extract everything from "# Releases" onward and replace with "# Changelog"
          CHANGELOG=$(echo "$PR_BODY" | sed -n '/^# Releases/,$p' | sed '1s/^# Releases/# Changelog/')

          # Pin the release tag to the exact commit that was built and published.
          # The app token ensures the release:published event triggers the
          # downstream Vercel production deploy workflow.
          gh release create "v${VERSION}" \
            --target "${{ github.sha }}" \
            --title "${RELEASE_DATE}" \
            --notes "$CHANGELOG"
        env:
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}