release.yml

# The GitHub Release for a v* tag (P11.25). docker-publish.yml builds the
# image for the same tag (0.4.0 and 0.4 from v0.4.0; latest stays on main).
# This workflow checks that the tag matches package.json and that "Checks"
# passed on the tagged commit as a push to main, Schema Drift and Build
# included, then creates the release from the version's CHANGELOG.md section.
# docs/releasing.md has the owner's procedure. Only the owner may push v*
# tags (tag ruleset).
name: Release

on:
  push:
    tags:
      - 'v*'

permissions: {}

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    # Checks may still be running when the tag is pushed; the wait below
    # gives it up to 90 minutes.
    timeout-minutes: 100
    permissions:
      contents: write
      actions: read

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: '24'

      - name: Check the tag matches package.json
        id: version
        env:
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          version="$(node -p "require('./package.json').version")"
          if [ "${TAG}" != "v${version}" ]; then
            echo "::error title=Release::The tag ${TAG} does not match package.json (${version}). Tag the merge commit of the chore(release) pull request."
            exit 1
          fi
          echo "version=${version}" >> "$GITHUB_OUTPUT"

      - name: Wait for Checks on the tagged commit
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          SHA: ${{ github.sha }}
        run: |
          set -euo pipefail
          for attempt in $(seq 1 90); do
            run="$(gh api "repos/${REPO}/actions/workflows/build.yml/runs?head_sha=${SHA}&event=push&branch=main&per_page=1" \
              --jq '.workflow_runs[0] // empty | "\(.id) \(.status) \(.conclusion)"')"
            if [ -z "${run}" ]; then
              echo "::error title=Release::No Checks run for ${SHA} as a push to main. Tag a commit on main."
              exit 1
            fi
            read -r id status conclusion <<<"${run}"
            if [ "${status}" = "completed" ]; then
              if [ "${conclusion}" != "success" ]; then
                echo "::error title=Release::Checks run ${id} on ${SHA} ended ${conclusion}. Fix main, then re-run this workflow."
                exit 1
              fi
              for job in "Schema Drift" "Build"; do
                result="$(gh api --paginate "repos/${REPO}/actions/runs/${id}/jobs" \
                  --jq ".jobs[] | select(.name == \"${job}\") | .conclusion")"
                if [ "${result}" != "success" ]; then
                  echo "::error title=Release::The ${job} job in Checks run ${id} is '${result:-missing}', not success."
                  exit 1
                fi
              done
              echo "Checks run ${id} passed on ${SHA}, Schema Drift and Build included."
              exit 0
            fi
            echo "Checks run ${id} is ${status} (attempt ${attempt} of 90); waiting a minute."
            sleep 60
          done
          echo "::error title=Release::Checks did not finish on ${SHA} within 90 minutes. Re-run this workflow once it has."
          exit 1

      - name: Create the GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          TAG: ${{ github.ref_name }}
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          set -euo pipefail
          node scripts/release/notes.mjs "${VERSION}" > "$RUNNER_TEMP/notes.md"
          prerelease=()
          if [[ "${VERSION}" == *-* ]]; then prerelease=(--prerelease); fi
          gh release create "${TAG}" --repo "${REPO}" --verify-tag --title "${TAG}" \
            --notes-file "$RUNNER_TEMP/notes.md" "${prerelease[@]}"