Primora/.github/workflows/release.yml

name: Release

# Triggered two ways:
#   1. Semver tags: git tag v0.3.0 && git push --tags (must match package.json).
#   2. workflow_run: after the CI workflow succeeds on master, the version in
#      root package.json is released automatically if no matching tag exists.
on:
  push:
    tags: ["v*.*.*"]
  workflow_run:
    workflows: ["CI"]
    types: [completed]
    branches: [master]

permissions:
  contents: write
  packages: write

jobs:
  verify:
    name: Verify version
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.check.outputs.version }}
      needed: ${{ steps.check.outputs.needed }}
    steps:
      - uses: actions/checkout@v4
      - name: Resolve version + decide whether to release
        id: check
        run: |
          if [ "${{ github.event_name }}" = "workflow_run" ]; then
            if [ "${{ github.event.workflow_run.conclusion }}" != "success" ]; then
              echo "CI did not succeed — skipping release."
              echo "needed=false" >> "$GITHUB_OUTPUT"
              exit 0
            fi
            VERSION="v$(node -p "require('./package.json').version")"
            if git ls-remote --exit-code --tags origin "refs/tags/$VERSION" > /dev/null 2>&1; then
              echo "$VERSION already released — nothing to do."
              echo "needed=false" >> "$GITHUB_OUTPUT"
              exit 0
            fi
          else
            VERSION="${{ github.ref_name }}"
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "needed=true" >> "$GITHUB_OUTPUT"
      - name: Check tag matches package versions
        if: steps.check.outputs.needed == 'true'
        env:
          VERSION: ${{ steps.check.outputs.version }}
        run: |
          PKG=$(node -p "require('./package.json').version")
          DESKTOP_PKG=$(node -p "require('./apps/desktop/package.json').version")
          TAURI=$(node -p "require('./apps/desktop/src-tauri/tauri.conf.json').version")
          if [ "v$PKG" != "$VERSION" ] || [ "$DESKTOP_PKG" != "$PKG" ] || [ "$TAURI" != "$PKG" ]; then
            echo "tag $VERSION mismatch: root=$PKG desktop=$DESKTOP_PKG tauri=$TAURI"
            exit 1
          fi

  images:
    name: Build + push ${{ matrix.app }}
    needs: verify
    if: needs.verify.outputs.needed == 'true'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        app: [backend, auth, frontend]
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3
      # ghcr.io requires lowercase repo paths; the owner login may be mixed-case.
      - name: Compute lowercase GHCR owner
        run: echo "GHCR_OWNER=${GITHUB_REPOSITORY_OWNER,,}" >> "$GITHUB_ENV"
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: apps/${{ matrix.app }}/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ghcr.io/${{ env.GHCR_OWNER }}/primora-${{ matrix.app }}:${{ needs.verify.outputs.version }}
            ghcr.io/${{ env.GHCR_OWNER }}/primora-${{ matrix.app }}:latest
          cache-from: type=gha,scope=${{ matrix.app }}
          cache-to: type=gha,mode=max,scope=${{ matrix.app }}

  cli-binaries:
    name: Compile ${{ matrix.name }}
    needs: verify
    if: needs.verify.outputs.needed == 'true'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - { target: bun-linux-x64, name: linux-x64 }
          - { target: bun-linux-arm64, name: linux-arm64 }
          - { target: bun-darwin-x64, name: darwin-x64 }
          - { target: bun-darwin-arm64, name: darwin-arm64 }
          - { target: bun-windows-x64, name: windows-x64, ext: .exe }
    steps:
      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v2
      - run: npm ci
      - name: Compile primora + primora-mcp
        run: |
          set -e
          mkdir -p dist-release
          bun build --compile apps/cli/src/cli.ts --target=${{ matrix.target }} --outfile dist-release/primora-${{ matrix.name }}${{ matrix.ext }}
          bun build --compile apps/mcp/src/server.ts --target=${{ matrix.target }} --outfile dist-release/primora-mcp-${{ matrix.name }}${{ matrix.ext }}
      - uses: actions/upload-artifact@v4
        with:
          name: binaries-${{ matrix.name }}
          path: dist-release/
          if-no-files-found: error

  desktop:
    name: Desktop bundle (${{ matrix.name }})
    needs: verify
    if: needs.verify.outputs.needed == 'true'
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { os: ubuntu-22.04, name: linux }
          - { os: macos-latest, name: macos }
          - { os: windows-latest, name: windows }
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
      - run: npm ci
      - name: Install Linux webview dependencies
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev patchelf
      - name: Build Tauri bundles
        run: npm run bundle --workspace @primora/desktop
      - uses: actions/upload-artifact@v4
        with:
          name: desktop-${{ matrix.name }}
          path: |
            apps/desktop/src-tauri/target/release/bundle/**/*.AppImage
            apps/desktop/src-tauri/target/release/bundle/**/*.deb
            apps/desktop/src-tauri/target/release/bundle/**/*.rpm
            apps/desktop/src-tauri/target/release/bundle/**/*.dmg
            apps/desktop/src-tauri/target/release/bundle/**/*.msi
            apps/desktop/src-tauri/target/release/bundle/**/*.exe
          if-no-files-found: error

  npm-packages:
    name: Pack npm tarballs
    needs: verify
    if: needs.verify.outputs.needed == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
      - run: npm ci
      - run: |
          npm run build --workspace @primora/cli
          npm run build --workspace @primora/mcp
          mkdir -p dist-release
          cd apps/cli && npm pack --pack-destination ../../dist-release
          cd ../mcp && npm pack --pack-destination ../../dist-release
      - uses: actions/upload-artifact@v4
        with:
          name: npm-tarballs
          path: dist-release/
          if-no-files-found: error

  release:
    name: GitHub Release
    needs: [verify, images, cli-binaries, desktop, npm-packages]
    if: needs.verify.outputs.needed == 'true'
    runs-on: ubuntu-latest
    env:
      VERSION: ${{ needs.verify.outputs.version }}
    steps:
      - uses: actions/checkout@v4
      # build-push-action uploads "*.dockerbuild" metadata artifacts that
      # download-artifact cannot extract — match only the real artifacts.
      - uses: actions/download-artifact@v4
        with:
          pattern: "binaries-*"
          merge-multiple: true
          path: dist-release
      - uses: actions/download-artifact@v4
        with:
          pattern: "desktop-*"
          merge-multiple: true
          path: dist-release
      - uses: actions/download-artifact@v4
        with:
          name: npm-tarballs
          path: dist-release
      # workflow_run runs leave the release untagged — create it so the
      # GitHub Release points at a real tag. GITHUB_TOKEN pushes do not
      # re-trigger workflows, so this cannot recurse.
      - name: Tag release
        if: github.event_name == 'workflow_run'
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git tag "$VERSION"
          git push origin "$VERSION"
      - name: Extract changelog section
        run: |
          awk -v ver="${VERSION#v}" '
            $0 ~ "^## \\[" ver "\\]" { flag=1; next }
            /^## \[/ && flag { exit }
            flag
          ' CHANGELOG.md > notes.md
          [ -s notes.md ] || echo "Release ${VERSION}" > notes.md
      - name: Create release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        # Desktop artifacts extract to nested dirs (appimage/, deb/, ...) —
        # a bare glob hands gh a directory and the upload dies mid-flight.
        run: |
          mapfile -t files < <(find dist-release -type f)
          [ ${#files[@]} -gt 0 ] || { echo "no release assets found"; exit 1; }
          gh release create "$VERSION" --title "$VERSION" --notes-file notes.md "${files[@]}"

  npm-publish:
    name: Publish to npm
    needs: release
    runs-on: ubuntu-latest
    env:
      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          registry-url: https://registry.npmjs.org
      - run: npm ci
      - run: npm run build --workspace @primora/cli && npm run build --workspace @primora/mcp
      - name: Publish @primora/cli + @primora/mcp
        if: env.NPM_TOKEN != ''
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          npm publish --workspace @primora/cli --access public
          npm publish --workspace @primora/mcp --access public
      - name: Note skipped publish
        if: env.NPM_TOKEN == ''
        run: echo "NPM_TOKEN secret not set — tarballs attached to the GitHub release instead."