release.yml

name: Release

# Tag-driven releases publish the tagged version. Every publish — prerelease and
# stable alike — runs in the reviewer-gated `Production` environment. npm supports
# only one trusted publisher per package with one optional environment claim, so
# pinning that publisher to `Production` requires every publishing job to run there.
# It also makes the `rc` a faithful rehearsal: it exercises the same environment and
# credential path the stable release will use, instead of a parallel one that can
# drift out from under it.
on:
  push:
    tags:
      - 'v*'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ══════════════════════════════════════════════════════════════════════════════
  # PUBLISH JOB
  # ══════════════════════════════════════════════════════════════════════════════
  release:
    name: Publish
    # Single environment for every tag — see the note at the top of this file.
    # Prereleases pay one approval click; that is the cost of the npm-side pin.
    environment: Production
    runs-on: ubuntu-latest
    timeout-minutes: 60
    permissions:
      contents: read # checkout (the tag already exists)
      id-token: write # OIDC token for npm Trusted Publishing

    env:
      PROJECT_NAME: '@aztec-foundation/aztec-standards'

    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0

      # Toolchain is pinned via package.json `config.aztecVersion`: this action
      # reads that field and installs the matching Aztec version.
      - name: Setup Aztec environment
        id: setup-aztec
        uses: AztecProtocol/aztec-ci-actions/actions/setup-aztec@431859e477234b8690eb1f80d1305d2e34f10f1b # v0.1.1
        with:
          start-pxe: 'false'
          run-codegen: 'true'

      # Validate that the tag (v5.0.0) matches package.json and derive the npm
      # dist-tag: `latest` for a final release, or the prerelease identifier
      # (rc / beta / nightly) so consumers can `npm i pkg@rc`.
      - name: Resolve release metadata
        id: meta
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          PKG_VERSION=$(node -p "require('./package.json').version")
          echo "Tag version: $VERSION"
          echo "package.json version: $PKG_VERSION"
          if [ "$VERSION" != "$PKG_VERSION" ]; then
            echo "::error::Tag ${GITHUB_REF_NAME} (version $VERSION) does not match package.json version ($PKG_VERSION)."
            exit 1
          fi

          if [[ "$VERSION" == *-* ]]; then
            PRERELEASE="${VERSION#*-}"     # e.g. "rc.2"
            DIST_TAG="${PRERELEASE%%.*}"   # e.g. "rc"
          else
            DIST_TAG="latest"
          fi

          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "dist_tag=$DIST_TAG" >> "$GITHUB_OUTPUT"
          echo "Resolved npm dist-tag: $DIST_TAG"

      - name: Build package
        run: yarn build

      - name: Setup Node.js for NPM publish
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          # npm Trusted Publishing requires Node >=22.14.0 and npm >=11.5.1.
          node-version: '22.14.0'
          registry-url: 'https://registry.npmjs.org'

      - name: Install OIDC-capable npm
        run: npm install --global npm@11.5.1

      # npm versions are immutable. OIDC supports publish but not dist-tag mutation,
      # so reruns verify the existing dist-tag rather than trying to repair it.
      - name: Publish to NPM with OIDC
        run: |
          cd "export/${PROJECT_NAME}"
          VERSION="${{ steps.meta.outputs.version }}"
          DIST_TAG="${{ steps.meta.outputs.dist_tag }}"
          if npm view "${PROJECT_NAME}@${VERSION}" version >/dev/null 2>&1; then
            TAGGED_VERSION=$(npm view "${PROJECT_NAME}@${DIST_TAG}" version 2>/dev/null || true)
            if [ "$TAGGED_VERSION" != "$VERSION" ]; then
              echo "::error::${PROJECT_NAME}@${VERSION} is already published, but dist-tag '${DIST_TAG}' points to '${TAGGED_VERSION:-nothing}'. OIDC cannot mutate dist-tags; repair it manually with an authorized npm account."
              exit 1
            fi
            echo "::notice::${PROJECT_NAME}@${VERSION} already published and dist-tag '${DIST_TAG}' is correct — skipping publish."
          else
            # Trusted Publishing generates provenance automatically for public packages.
            npm publish --access public --tag "${DIST_TAG}"
          fi

      # Post-publish smoke test: install the just-published package from the registry (clean dir)
      # and confirm it resolves to the expected version. Catches "published but unusable"
      # (bad files/exports/version). The publish already succeeded and npm is immutable, so a
      # persistent miss here is a WARNING (registry propagation lag — common on a first publish),
      # NOT a release failure. A version MISMATCH after install still hard-fails.
      - name: Smoke-test published package
        run: |
          VERSION="${{ steps.meta.outputs.version }}"
          DIST_TAG="${{ steps.meta.outputs.dist_tag }}"
          workdir="$(mktemp -d)"
          cd "$workdir"
          npm init -y >/dev/null
          # First publishes propagate slowly; --prefer-online bypasses the negative cache. Back off ~2min.
          installed=false
          for attempt in 1 2 3 4 5 6 7 8; do
            if npm install --prefer-online "${PROJECT_NAME}@${VERSION}"; then installed=true; break; fi
            echo "install attempt ${attempt} failed; waiting 15s for registry propagation..."
            sleep 15
          done
          if [ "$installed" = true ]; then
            node -e "const p = require('${PROJECT_NAME}/package.json'); if (p.version !== '${VERSION}') { throw new Error('installed ' + p.version + ', expected ${VERSION}'); } console.log('smoke ok:', p.name, p.version);"
            echo "::notice::Smoke test passed: ${PROJECT_NAME}@${VERSION} installs and resolves (dist-tag ${DIST_TAG})."
          else
            echo "::warning::${PROJECT_NAME}@${VERSION} published successfully but did not resolve from the registry within the wait window (propagation lag — common on a first publish). Verify manually: npm view ${PROJECT_NAME}@${VERSION} --prefer-online"
          fi