release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      dry-run-enabled:
        description: 'Perform Dry Run'
        type: boolean
        required: false
        default: true
      release-type:
        description: 'Release type'
        type: choice
        required: true
        default: standard
        options:
          - standard
          - rc

defaults:
  run:
    shell: bash

env:
  DRY_RUN_ENABLED: ${{ inputs.dry-run-enabled && 'true' || 'false' }}
  RELEASE_TYPE: ${{ inputs.release-type }}

permissions:
  actions: write
  checks: write
  contents: write
  id-token: write
  issues: write
  pull-requests: write
  packages: write

jobs:
  # ─────────────────────────────────────────────────────────────────────────────
  # When RC is requested from main, create the rc/ branch and re-dispatch
  # this workflow on that branch. The current run then exits.
  # ─────────────────────────────────────────────────────────────────────────────
  dispatch-rc:
    name: Release / Dispatch RC
    if: ${{ inputs.release-type == 'rc' && github.ref_name == github.event.repository.default_branch }}
    runs-on: hl-contr-lin-lg
    steps:
      - name: Prepare Job
        uses: pandaswhocode/initialize-github-job@d93cd457947758129c6d93e09f89ad528119960f # 1.0.8
        with:
          checkout: 'true'
          checkout-ref: '${{ github.ref }}'
          checkout-token: '${{ secrets.GH_ACCESS_TOKEN }}'
          setup-node: 'true'
          node-version: '24.12.0'
          node-registry: 'https://registry.npmjs.org/'

      - name: Create RC branch and dispatch workflow
        env:
          GH_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
        run: |
          VER=$(jq -r '.version' package.json)
          VER=${VER%-SNAPSHOT}
          RC_BRANCH="rc/${VER}"

          if git ls-remote --heads origin "${RC_BRANCH}" | grep -q "${RC_BRANCH}"; then
            echo "::notice::RC branch already exists: ${RC_BRANCH}"
          else
            git config user.name "${{ vars.GIT_USER_NAME }}"
            git config user.email "${{ vars.GIT_USER_EMAIL }}"
            git checkout -b "${RC_BRANCH}"
            git push origin "${RC_BRANCH}"
            echo "::notice::Created RC branch: ${RC_BRANCH}"
          fi

          echo "::notice::Dispatching release workflow on ${RC_BRANCH}"
          gh workflow run release.yml \
            --ref "${RC_BRANCH}" \
            -f release-type=rc \
            -f dry-run-enabled=${{ inputs.dry-run-enabled }}

  # ─────────────────────────────────────────────────────────────────────────────
  # Prepare: calculate the next version via semantic-release dry-run
  # Runs for standard releases on main, or RC releases on rc/* branches.
  # ─────────────────────────────────────────────────────────────────────────────
  prepare-release:
    name: Release / Prepare
    if: ${{ (inputs.release-type == 'standard' && github.ref_name == github.event.repository.default_branch) || (inputs.release-type == 'rc' && startsWith(github.ref_name, 'rc/')) }}
    runs-on: hl-contr-lin-lg
    outputs:
      version: ${{ steps.set-outputs.outputs.version }}
      need-release: ${{ steps.set-outputs.outputs.need-release }}
      next_version_snapshot: ${{ steps.release_meta.outputs.next_version_snapshot }}
      pr_title: ${{ steps.release_meta.outputs.pr_title }}
      milestone: ${{ steps.release_meta.outputs.milestone }}
      is_prerelease: ${{ steps.release_meta.outputs.is_prerelease }}
      npm_dist_tag: ${{ steps.release_mode.outputs.npm_dist_tag }}
    steps:
      - name: Prepare Job
        uses: pandaswhocode/initialize-github-job@d93cd457947758129c6d93e09f89ad528119960f # 1.0.8
        with:
          checkout: 'true'
          checkout-ref: '${{ github.ref }}'
          checkout-token: '${{ secrets.GH_ACCESS_TOKEN }}'
          setup-node: 'true'
          node-version: '24.12.0'
          node-registry: 'https://registry.npmjs.org/'

      - name: Select release mode
        id: release_mode
        run: |
          if [[ "${RELEASE_TYPE}" == "rc" ]]; then
            echo "npm_dist_tag=rc" >> "${GITHUB_OUTPUT}"
            echo "::notice::Using RC release mode on branch ${{ github.ref_name }}"
          else
            echo "npm_dist_tag=latest" >> "${GITHUB_OUTPUT}"
            echo "::notice::Using standard release mode"
          fi

      - name: Install Semantic Release
        working-directory: contracts
        run: |
          npm install --no-save \
            semantic-release@25.0.2 @semantic-release/git@10.0.1 @semantic-release/github@12.0.2 \
            @semantic-release/exec@7.1.0 @commitlint/config-conventional@18.6.0 @commitlint/cli@18.6.0 \
            marked-mangle@1.1.6 marked-gfm-heading-id@3.1.2 conventional-changelog-conventionalcommits@9.1.0 \
            @semantic-release/commit-analyzer@13.0.1

      - name: Calculate Next Version
        id: calculate-version
        working-directory: contracts
        env:
          GITHUB_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
          GIT_AUTHOR_NAME: ${{ vars.GIT_USER_NAME }}
          GIT_AUTHOR_EMAIL: ${{ vars.GIT_USER_EMAIL }}
          GIT_COMMITTER_NAME: ${{ vars.GIT_USER_NAME }}
          GIT_COMMITTER_EMAIL: ${{ vars.GIT_USER_EMAIL }}
        run: |
          PROCEED="true"
          SEMREL_OUTPUT=""

          if SEMREL_OUTPUT=$(npx semantic-release --dry-run 2>&1); then
            if echo "${SEMREL_OUTPUT}" | grep -q "The next release version is"; then
              echo "::notice::Semantic Release detected a new version"
              NEXT_VER=$(echo "${SEMREL_OUTPUT}" | sed -n 's/.*The next release version is \([^[:space:]]*\).*/\1/p' | head -n1)
              if [[ -n "${NEXT_VER}" ]]; then
                echo "${NEXT_VER}" > VERSION
                echo "::notice::Parsed next version: ${NEXT_VER}"
              fi
            else
              echo "::notice::Semantic Release detected NO new version"
              PROCEED="false"
            fi
          else
            echo "::notice::Semantic Release did NOT run successfully"
            PROCEED="false"
          fi

          if [[ -n "${SEMREL_OUTPUT}" ]]; then
            echo "::group::SemVer output"
            echo "${SEMREL_OUTPUT}"
            echo "::endgroup::"
          fi

          echo "need-release=${PROCEED}" >> "${GITHUB_OUTPUT}"

      - name: Extract version
        id: set-outputs
        working-directory: contracts
        if: ${{ always() }}
        run: |
          PROCEED="true"
          OUTVER=""

          if [[ "${{ steps.calculate-version.outputs.need-release }}" == "true" ]] && [[ -f VERSION ]]; then
            TRIMMED_VERSION=$(tr -d '[:space:]' < VERSION)
            OUTVER="${TRIMMED_VERSION}"
            echo "Using computed version: ${TRIMMED_VERSION}"
          else
            PROCEED="false"
          fi

          echo "Version: ${OUTVER}"
          echo "version=${OUTVER}" >> "${GITHUB_OUTPUT}"
          echo "need-release=${PROCEED}" >> "${GITHUB_OUTPUT}"

      - name: Parse Version
        if: ${{ steps.set-outputs.outputs.need-release == 'true' }}
        id: version_parser
        uses: step-security/semver-utils@4ae9c1fd6d1c5f8f152fe7e2efe8069a952c2ace # v4.3.2
        with:
          lenient: false
          version: ${{ steps.set-outputs.outputs.version }}

      - name: Set Release Environment Variables
        if: ${{ steps.set-outputs.outputs.need-release == 'true' }}
        id: release_meta
        run: |
          IS_PRERELEASE="false"
          if [[ "${{ steps.set-outputs.outputs.version }}" == *-* ]]; then
            IS_PRERELEASE="true"
          fi

          PREMINOR_VERSION='${{ steps.version_parser.outputs.inc-preminor }}'
          NEXT_VERSION_SNAPSHOT=${PREMINOR_VERSION//-0/-SNAPSHOT}
          PR_TITLE="chore(release): Bump versions for v$NEXT_VERSION_SNAPSHOT"
          MILESTONE='${{ steps.version_parser.outputs.release }}'

          echo "next_version_snapshot=$NEXT_VERSION_SNAPSHOT" >> "$GITHUB_OUTPUT"
          echo "pr_title=$PR_TITLE" >> "$GITHUB_OUTPUT"
          echo "milestone=$MILESTONE" >> "$GITHUB_OUTPUT"
          echo "is_prerelease=$IS_PRERELEASE" >> "$GITHUB_OUTPUT"

  # ─────────────────────────────────────────────────────────────────────────────
  # Run semantic-release for real, create GitHub release, pack tarball
  # ─────────────────────────────────────────────────────────────────────────────
  create-github-release:
    name: Release / Github
    if: ${{ needs.prepare-release.outputs.need-release == 'true' }}
    runs-on: hl-contr-lin-lg
    needs:
      - prepare-release
    outputs:
      npm-artifact-name: ${{ steps.set-publish-data.outputs.artifact-name }}

    steps:
      - name: Prepare Job
        uses: pandaswhocode/initialize-github-job@d93cd457947758129c6d93e09f89ad528119960f # 1.0.8
        with:
          checkout: 'true'
          checkout-ref: '${{ github.ref }}'
          checkout-token: '${{ secrets.GH_ACCESS_TOKEN }}'
          setup-node: 'true'
          node-version: '24.12.0'
          node-registry: 'https://registry.npmjs.org/'

      - name: Install GnuPG Tools
        run: |
          if ! command -v gpg2 >/dev/null 2>&1; then
            echo "::group::Updating APT Repository Indices"
              sudo apt update
            echo "::endgroup::"
            echo "::group::Installing GnuPG Tools"
              sudo apt install -y gnupg2
            echo "::endgroup::"
          fi

      - name: Import GPG key
        id: gpg_importer
        uses: step-security/ghaction-import-gpg@69c854a83c7f79463f8bdf46772ab09826c560cd # v6.3.1
        with:
          gpg_private_key: ${{ secrets.GPG_KEY_CONTENTS }}
          passphrase: ${{ secrets.GPG_KEY_PASSPHRASE }}
          git_config_global: true
          git_user_signingkey: true
          git_commit_gpgsign: true
          git_tag_gpgsign: false

      - name: Install Semantic Release
        working-directory: contracts
        run: |
          npm install --no-save \
            semantic-release@25.0.2 @semantic-release/git@10.0.1 @semantic-release/github@12.0.2 \
            @semantic-release/exec@7.1.0 @commitlint/config-conventional@18.6.0 @commitlint/cli@18.6.0 \
            marked-mangle@1.1.6 marked-gfm-heading-id@3.1.2 conventional-changelog-conventionalcommits@9.1.0 \
            @semantic-release/commit-analyzer@13.0.1

      # Install deps so the custom bump script can run as part of semantic-release
      - name: Install dependencies
        run: npm ci

      - name: Publish Semantic Release
        env:
          GITHUB_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
          GIT_AUTHOR_NAME: ${{ vars.GIT_USER_NAME }}
          GIT_AUTHOR_EMAIL: ${{ vars.GIT_USER_EMAIL }}
          GIT_COMMITTER_NAME: ${{ vars.GIT_USER_NAME }}
          GIT_COMMITTER_EMAIL: ${{ vars.GIT_USER_EMAIL }}
        working-directory: contracts
        run: |
          FLAGS=""
          if [[ "${DRY_RUN_ENABLED}" == "true" ]]; then
            FLAGS="--dry-run"
          fi

          npx semantic-release --no-sign ${FLAGS}

          if [[ -d "dist" ]]; then
            echo "Dist dir has the following contents:"
            ls dist
          fi

      - name: Update Version for Dry Run
        if: ${{ inputs.dry-run-enabled }}
        working-directory: contracts
        run: |
          npm version ${{ needs.prepare-release.outputs.version }} --no-git-tag-version

      - name: Set Publish Data
        id: set-publish-data
        working-directory: contracts
        run: |
          CLI_NPM_PACKAGE_NAME="hiero-ledger-hiero-contracts-${{ needs.prepare-release.outputs.version }}.tgz"
          echo "artifact-name=${CLI_NPM_PACKAGE_NAME}" >> $GITHUB_OUTPUT

      - name: Pack Tarball
        working-directory: contracts
        run: |
          npm pack

      - name: Verify Package
        working-directory: contracts
        run: |
          EXPECTED="./${{ steps.set-publish-data.outputs.artifact-name }}"
          if [[ ! -f "${EXPECTED}" ]]; then
            echo "::error::Expected package not found: ${EXPECTED}"
            ls -la .
            exit 1
          fi
          echo "Package verified: ${EXPECTED} ($(du -h "${EXPECTED}" | cut -f1))"

      - name: Upload Hiero CLI Package Artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: contracts-npm-package
          path: ./contracts/${{ steps.set-publish-data.outputs.artifact-name }}
          if-no-files-found: error

      - name: Close the Milestone
        if: ${{ needs.prepare-release.outputs.is_prerelease != 'true' && !inputs.dry-run-enabled }}
        id: milestone
        uses: step-security/close-milestone@d6e3b63e31f1f869bd3d0403f8cdc1a68f59ab4a # v2.2.2
        with:
          milestone_name: ${{ needs.prepare-release.outputs.version }}
        env:
          GITHUB_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}

  # ─────────────────────────────────────────────────────────────────────────────
  # Bump to next SNAPSHOT version (standard releases only)
  # ─────────────────────────────────────────────────────────────────────────────
  create-snapshot-pr:
    name: Release / Snapshot
    runs-on: hl-contr-lin-lg
    needs:
      - prepare-release
      - create-github-release
    if: ${{ needs.prepare-release.outputs.need-release == 'true' && !inputs.dry-run-enabled && inputs.release-type == 'standard' }}
    env:
      NEXT_VERSION_SNAPSHOT: ${{ needs.prepare-release.outputs.next_version_snapshot }}
      PR_TITLE: ${{ needs.prepare-release.outputs.pr_title }}
      MILESTONE: ${{ needs.prepare-release.outputs.milestone }}
    steps:
      - name: Prepare Job
        uses: pandaswhocode/initialize-github-job@d93cd457947758129c6d93e09f89ad528119960f # 1.0.8
        with:
          checkout: 'true'
          checkout-ref: '${{ github.event.repository.default_branch }}'
          checkout-token: '${{ secrets.GH_ACCESS_TOKEN }}'
          setup-node: 'true'
          node-version: '24.12.0'
          node-registry: 'https://registry.npmjs.org/'

      - name: Install GnuPG Tools
        run: |
          if ! command -v gpg2 >/dev/null 2>&1; then
            echo "::group::Updating APT Repository Indices"
              sudo apt update
            echo "::endgroup::"
            echo "::group::Installing GnuPG Tools"
              sudo apt install -y gnupg2
            echo "::endgroup::"
          fi

      - name: Import GPG key
        id: gpg_importer
        uses: step-security/ghaction-import-gpg@69c854a83c7f79463f8bdf46772ab09826c560cd # v6.3.1
        with:
          gpg_private_key: ${{ secrets.GPG_KEY_CONTENTS }}
          passphrase: ${{ secrets.GPG_KEY_PASSPHRASE }}
          git_config_global: true
          git_user_signingkey: true
          git_commit_gpgsign: true
          git_tag_gpgsign: false

      # DO NOT move to /contracts - root install is required for workspace consistency
      - name: Install dependencies
        run: npm ci

      # Updates the version in package.json with the next snapshot version
      - name: Bump Versions
        env:
          SEM_VER: ${{ env.NEXT_VERSION_SNAPSHOT }}
          SNAPSHOT: 'true'
        run: node scripts/bump-contracts-version.js

      - name: Create Pull Request
        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
        with:
          body: |
            **Description**:
            Bump versions for v${{ env.NEXT_VERSION_SNAPSHOT }}
            Automated snapshot version bump for the next development cycle.

            **Related issue(s)**:
          branch: create-pull-request/${{ env.NEXT_VERSION_SNAPSHOT }}
          commit-message: ${{ env.PR_TITLE }}
          committer: ${{ steps.gpg_importer.outputs.name || vars.GIT_USER_NAME || 'release-automation' }} <${{ steps.gpg_importer.outputs.email || vars.GIT_USER_EMAIL || 'automation@users.noreply.github.com' }}>
          author: ${{ steps.gpg_importer.outputs.name || vars.GIT_USER_NAME || 'release-automation' }} <${{ steps.gpg_importer.outputs.email || vars.GIT_USER_EMAIL || 'automation@users.noreply.github.com' }}>
          delete-branch: true
          signoff: true
          title: ${{ env.PR_TITLE }}
          milestone: ${{ env.MILESTONE }}
          labels: 'process'
          token: ${{ secrets.GH_ACCESS_TOKEN }}

  # ─────────────────────────────────────────────────────────────────────────────
  # Publish the npm package
  # ─────────────────────────────────────────────────────────────────────────────
  publish-npm-package:
    name: Release / Publish Hiero Contracts NPM package
    if: ${{ needs.prepare-release.outputs.need-release == 'true' && !inputs.dry-run-enabled }}
    runs-on: ubuntu-latest
    needs:
      - prepare-release
      - create-github-release
    steps:
      - name: Prepare Release
        uses: pandaswhocode/initialize-github-job@d93cd457947758129c6d93e09f89ad528119960f # 1.0.8
        with:
          checkout: 'true'
          checkout-ref: '${{ github.ref }}'
          checkout-token: '${{ secrets.GH_ACCESS_TOKEN }}'
          setup-node: 'true'
          node-version: '24.12.0'
          node-registry: 'https://registry.npmjs.org/'

      - name: Download Hiero Contracts NPM package artifact
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          name: contracts-npm-package
          path: contracts

      - name: Publish Hiero Contracts NPM package
        working-directory: contracts
        run: |
          args="--access=public"

          if [[ "${{ needs.prepare-release.outputs.npm_dist_tag }}" != "latest" ]]; then
            args="${args} --tag ${{ needs.prepare-release.outputs.npm_dist_tag }}"
          fi

          args="${args} --provenance"

          package="${{ needs.create-github-release.outputs.npm-artifact-name }}"
          echo "::group::Publishing package: ${package} with args: ${args}"
          npm publish ${package} ${args}
          echo "::endgroup::"