release.yml

name: Release

on:
  push:
    tags:
      - 'v*.*.*'

jobs:
  # The tag is the release. Everything downstream must agree with it, because the
  # running server reports its version from package.json (server.js, tx/tx.js),
  # NOT from the APP_VERSION build arg - so a package.json left on the previous
  # number ships an image that calls itself by the wrong release for its whole
  # life. v0.13.3 went out that way. Nothing here rewrites the version: a
  # mismatch fails the release so the commit gets fixed and re-tagged.
  verify-version:
    name: Verify Version
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Check package.json and package-lock.json against the tag
        run: |
          VERSION=${GITHUB_REF#refs/tags/v}
          echo "tag version: $VERSION"

          fail=0
          check() {
            local label="$1" actual="$2"
            echo "  $label = ${actual:-<missing>}"
            if [ "$actual" != "$VERSION" ]; then
              echo "::error::$label is '${actual:-<missing>}' but the tag is v$VERSION"
              fail=1
            fi
          }

          check "package.json version"              "$(jq -r '.version' package.json)"
          check "package-lock.json version"         "$(jq -r '.version' package-lock.json)"
          check 'package-lock.json packages[""]'    "$(jq -r '.packages."".version' package-lock.json)"

          if [ "$fail" -ne 0 ]; then
            echo "::error::Release aborted. On main: npm version --no-git-tag-version $VERSION && npm install --package-lock-only"
            echo "::error::then commit, delete the tag (git tag -d v$VERSION && git push origin :refs/tags/v$VERSION) and re-tag."
            exit 1
          fi
          echo "OK: package.json and package-lock.json agree with the tag"

  test:
    name: Test
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Use Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '24'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run tests
        run: npm run test:ci
        env:
          SUPPRESS_LOGS: 'true'

      - name: Upload test results
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: test-results
          path: ./test-results/junit.xml

      - name: Upload coverage reports
        uses: codecov/codecov-action@v4
        with:
          directory: ./coverage/
          token: ${{ secrets.CODECOV_TOKEN }}

  release:
    name: Create Release
    runs-on: ubuntu-latest
    needs: [verify-version, test]

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Get version from tag
        id: get_version
        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT

      - name: Extract release notes from CHANGELOG.md
        id: extract_release_notes
        run: |
          VERSION=$(echo ${{ steps.get_version.outputs.VERSION }} | sed 's/^v//')
          # Extract section for current version from CHANGELOG. The 'v' is optional in the
          # heading: the tag always has one, the changelog heading only sometimes does, and
          # insisting on it is why every release from v0.11.0 on shipped with no notes.
          SECTION=$(sed -n "/^## \\[v\\?${VERSION}\\]/,/^## \\[v\\?[0-9]\\+\\.[0-9]\\+\\.[0-9]\\+\\]/p" CHANGELOG.md | sed '$d')
          
          # If no section found, use a default message. Say so in the job as well: this is a
          # release going out without notes, which is worth seeing at the time rather than
          # discovering later on the releases page.
          if [ -z "$SECTION" ]; then
            echo "::warning::No CHANGELOG.md section found for ${VERSION} in the tagged commit - releasing without notes"
            SECTION=$(printf '## [v%s] - %s\nNo detailed release notes available: CHANGELOG.md at this tag has no entry for %s.' "${VERSION}" "$(date +%Y-%m-%d)" "${VERSION}")
          fi
          
          # Write multiline release notes using heredoc delimiter
          echo "RELEASE_NOTES<<EOF" >> $GITHUB_OUTPUT
          echo "$SECTION" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v1
        with:
          tag_name: ${{ steps.get_version.outputs.VERSION }}
          name: Release ${{ steps.get_version.outputs.VERSION }}
          body: ${{ steps.extract_release_notes.outputs.RELEASE_NOTES }}
          draft: false
          prerelease: false
          token: ${{ secrets.GITHUB_TOKEN }}

  npm-publish:
    name: Publish to NPM
    runs-on: ubuntu-latest
    needs: [verify-version, test]
    permissions:
      contents: read
      id-token: write

    steps:
      - uses: actions/checkout@v4

      - name: Use Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '24'
          cache: 'npm'
          registry-url: 'https://registry.npmjs.org'

      - name: Install dependencies
        run: npm ci

      - name: Get version from tag
        id: get_version
        run: |
          VERSION=${GITHUB_REF#refs/tags/v}
          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT

      - name: Update package.json version
        run: npm pkg set version=${{ steps.get_version.outputs.VERSION }}

      - name: Publish to npm
        run: npm publish --access public --provenance
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

  docker:
    name: Build and Push Docker Image
    runs-on: ubuntu-latest
    needs: release
    permissions:
      contents: read
      packages: write

    steps:
      - uses: actions/checkout@v4

      - name: Get version from tag
        id: get_version
        run: |
          VERSION=${GITHUB_REF#refs/tags/}
          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
          echo "VERSION_NO_V=${VERSION#v}" >> $GITHUB_OUTPUT
          echo "CREATED=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> $GITHUB_OUTPUT

      - name: Set lowercase repository name
        run: echo "REPO_LC=${GITHUB_REPOSITORY,,}" >> $GITHUB_ENV

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          platforms: linux/amd64,linux/arm64
          tags: |
            ghcr.io/${{ env.REPO_LC }}:latest
            ghcr.io/${{ env.REPO_LC }}:${{ steps.get_version.outputs.VERSION }}
            ghcr.io/${{ env.REPO_LC }}:${{ steps.get_version.outputs.VERSION_NO_V }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            VERSION=${{ steps.get_version.outputs.VERSION_NO_V }}
            REVISION=${{ github.sha }}
            CREATED=${{ steps.get_version.outputs.CREATED }}