release-publish.yml

name: 'Release: Publish'

on:
  pull_request:
    types:
      - closed
    branches:
      - 'release/*'

jobs:
  determine-version-info:
    name: Determine publishing track
    runs-on: ubuntu-latest
    if: github.event.pull_request.merged == true
    outputs:
      track: ${{ steps.determine-info.outputs.track }}
      previous_version: ${{ steps.determine-info.outputs.previous_version }}
      version: ${{ steps.determine-info.outputs.version }}
      bump: ${{ steps.determine-info.outputs.bump }}
      new_stable_version: ${{ steps.determine-info.outputs.new_stable_version }}
      release_type: ${{ steps.determine-info.outputs.release_type }}
      rc_branch: ${{ steps.determine-info.outputs.rc_branch }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 1
          fetch-tags: true

      - name: Setup Node.js
        uses: ./.github/actions/setup-nodejs
        with:
          build-command: ''
          install-command: pnpm install --frozen-lockfile --dir ./.github/scripts --ignore-workspace
          cache-dependency-path: .github/scripts/pnpm-lock.yaml

      - name: Determine track from package version number
        id: determine-info
        run: node .github/scripts/determine-version-info.mjs

  publish-to-npm:
    name: Publish to NPM
    needs: [determine-version-info]
    runs-on: ubuntu-latest
    if: github.event.pull_request.merged == true
    timeout-minutes: 30
    environment: npm
    permissions:
      id-token: write
    env:
      NPM_CONFIG_PROVENANCE: true
      RELEASE: ${{ needs.determine-version-info.outputs.version }} # Used by Vite build process
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup and Build
        uses: ./.github/actions/setup-nodejs
        env:
          N8N_FAIL_ON_POPULARITY_FETCH_ERROR: true
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}

      - name: Install script dependencies
        run: pnpm install --frozen-lockfile --dir ./.github/scripts --ignore-workspace

      - name: Check for new unpublished packages
        run: node .github/scripts/detect-new-packages.mjs

      - name: Dry-run publishing
        run: |
          pnpm --filter n8n publish --no-git-checks --dry-run
          pnpm publish -r --filter '!n8n' --no-git-checks --dry-run

      - name: Pre publishing changes
        run: |
          node .github/scripts/trim-fe-packageJson.js
          node .github/scripts/ensure-provenance-fields.mjs
          cp README.md packages/cli/README.md
          sed -i "s/default: 'dev'/default: '${{ needs.determine-version-info.outputs.release_type }}'/g" packages/cli/dist/config/schema.js

      # Publishing via `pnpm publish -r` is idempotent, as it checks if the package exists
      # and only publishes if it doesn't. This is why we do the sub-packages before the main n8n package.
      # So if anything goes wrong, we can easily re-try the run instead of abandoning the release.
      - name: Publish other packages to NPM
        env:
          PUBLISH_BRANCH: ${{ github.event.pull_request.base.ref }}
          PUBLISH_TAG: ${{ needs.determine-version-info.outputs.track }}
        run: |
          # Prefix version-like track names (e.g. "1", "v1") to avoid npm rejecting them as semver ranges
          if [[ "$PUBLISH_TAG" =~ ^v?[0-9] ]]; then
            PUBLISH_TAG="release-${PUBLISH_TAG}"
          fi
          pnpm publish -r --filter '!n8n' --publish-branch "$PUBLISH_BRANCH" --access public --tag "$PUBLISH_TAG" --no-git-checks

      # If we don't use the --tag rc, all releases will default to "latest".
      - name: Publish n8n to NPM with rc tag
        env:
          PUBLISH_BRANCH: ${{ github.event.pull_request.base.ref }}
        run: pnpm --filter n8n publish --publish-branch "$PUBLISH_BRANCH" --access public --tag rc --no-git-checks

      - name: Cleanup rc tag
        run: npm dist-tag rm n8n rc
        continue-on-error: true

  publish-to-docker-hub:
    name: Publish to DockerHub
    needs: [determine-version-info]
    uses: ./.github/workflows/docker-build-push.yml
    with:
      n8n_version: ${{ needs.determine-version-info.outputs.version }}
      release_type: ${{ needs.determine-version-info.outputs.release_type }}
      create_attestations: true
    secrets: inherit

  build-daytona-snapshot:
    name: Build Daytona snapshot
    needs: [determine-version-info, publish-to-npm]
    if: github.event.pull_request.merged == true
    uses: ./.github/workflows/release-build-daytona-snapshot.yml
    with:
      n8n_version: ${{ needs.determine-version-info.outputs.version }}
    secrets: inherit

  create-github-release:
    name: Create GitHub Release
    needs: [determine-version-info, publish-to-npm, publish-to-docker-hub]
    if: github.event.pull_request.merged == true
    uses: ./.github/workflows/release-create-github-releases.yml
    with:
      track: ${{ needs.determine-version-info.outputs.track }}
      version-tag: 'n8n@${{ needs.determine-version-info.outputs.version }}'
      body: ${{ github.event.pull_request.body }}
      commit: ${{ github.event.pull_request.base.ref }}
      is_experimental: ${{ needs.determine-version-info.outputs.release_type == 'rc' }}
    secrets: inherit

  move-track-tag:
    name: Move track tag
    needs: [determine-version-info, create-github-release]
    if: |
      github.event.pull_request.merged == true &&
      needs.determine-version-info.outputs.release_type != 'rc'
    uses: ./.github/workflows/release-update-pointer-tag.yml
    with:
      track: ${{ needs.determine-version-info.outputs.track }}
      version-tag: 'n8n@${{ needs.determine-version-info.outputs.version }}'
    secrets: inherit

  promote-stable-tag:
    name: Promote stable tag (minor bump)
    needs: [determine-version-info, create-github-release]
    if: |
      github.event.pull_request.merged == true &&
      needs.determine-version-info.outputs.new_stable_version != ''
    uses: ./.github/workflows/release-update-pointer-tag.yml
    with:
      track: stable
      version-tag: 'n8n@${{ needs.determine-version-info.outputs.new_stable_version }}'
    secrets: inherit

  generate-and-attach-sbom:
    name: Generate and Attach SBOM to Release
    needs: [determine-version-info, create-github-release]
    uses: ./.github/workflows/sbom-generation-callable.yml
    with:
      n8n_version: ${{ needs.determine-version-info.outputs.version }}
      release_tag_ref: 'n8n@${{ needs.determine-version-info.outputs.version }}'
    secrets: inherit

  merge-release-tag-to-master:
    name: Merge release tag to master on minor release
    needs: [determine-version-info, publish-to-npm, create-github-release]
    if: |
      github.event.pull_request.merged == true &&
      needs.determine-version-info.outputs.bump == 'minor' &&
      needs.determine-version-info.outputs.release_type != 'rc'
    uses: ./.github/workflows/release-merge-tag-to-branch.yml
    with:
      version: ${{ needs.determine-version-info.outputs.version }}
      target-branch: master
    secrets: inherit

  merge-release-tag-to-rc-branch:
    name: Merge release tag to RC branch on patch release
    needs: [determine-version-info, publish-to-npm, create-github-release]
    if: |
      github.event.pull_request.merged == true &&
      needs.determine-version-info.outputs.bump == 'patch' &&
      needs.determine-version-info.outputs.release_type != 'rc'
    uses: ./.github/workflows/release-merge-tag-to-branch.yml
    with:
      version: ${{ needs.determine-version-info.outputs.version }}
      target-branch: ${{ needs.determine-version-info.outputs.rc_branch }}
    secrets: inherit

  post-release:
    name: Run Post-release actions
    needs:
      [
        determine-version-info,
        publish-to-npm,
        create-github-release,
        move-track-tag,
        promote-stable-tag,
        build-daytona-snapshot,
      ]
    if: |
      always() &&
      needs.publish-to-npm.result == 'success' &&
      needs.create-github-release.result == 'success' &&
      needs.build-daytona-snapshot.result == 'success' &&
      (needs.move-track-tag.result == 'success' || needs.move-track-tag.result == 'skipped') &&
      (needs.promote-stable-tag.result == 'success' || needs.promote-stable-tag.result == 'skipped')
    uses: ./.github/workflows/release-publish-post-release.yml
    with:
      track: ${{ needs.determine-version-info.outputs.track }}
      previous_version: ${{ needs.determine-version-info.outputs.previous_version }}
      version: ${{ needs.determine-version-info.outputs.version }}
      bump: ${{ needs.determine-version-info.outputs.bump }}
      new_stable_version: ${{ needs.determine-version-info.outputs.new_stable_version }}
      release_type: ${{ needs.determine-version-info.outputs.release_type }}
    secrets: inherit

  notify-on-failure:
    name: Notify Slack on failure
    needs:
      [
        determine-version-info,
        publish-to-npm,
        publish-to-docker-hub,
        build-daytona-snapshot,
        create-github-release,
        move-track-tag,
        promote-stable-tag,
        generate-and-attach-sbom,
        merge-release-tag-to-master,
        merge-release-tag-to-rc-branch,
        post-release,
      ]
    if: |
      always() &&
      github.event.pull_request.merged == true &&
      (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled'))
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: master
          sparse-checkout: .github/scripts/slack
          sparse-checkout-cone-mode: false
      - name: Notify Slack
        env:
          SLACK_TOKEN: ${{ secrets.RELEASE_HELPER_SLACK_TOKEN }}
        run: |
          node .github/scripts/slack/notify.mjs \
            --channel C036AELNMV0 \
            --text '<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|Release publish failed for n8n@${{ needs.determine-version-info.outputs.version }}>. Please go to the actions page and retry failed runs to recover a flake in the release pipeline. <!subteam^S08FYH9C9ME|@release-captain>'