release.yml

name: Release

on:
  push:
    branches:
      - main
  workflow_dispatch: {}

permissions:
  contents: write
  pull-requests: write

jobs:
  release:
    runs-on: ubuntu-latest
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - name: Check out repository
        uses: actions/checkout@v5
        with:
          fetch-depth: 0
          # Needed so `changeset tag` sees already-released tags as
          # existing — otherwise it would re-tag HEAD with a name that
          # already points at a different commit on the remote, and the
          # subsequent `git push` would fail.
          fetch-tags: true

      - name: Set up pnpm
        uses: pnpm/action-setup@v5
        with:
          version: 9.12.0

      - name: Set up Node.js
        uses: actions/setup-node@v5
        with:
          node-version: 22
          cache: pnpm

      # Bun cross-compiles the per-platform vicoop-client binaries from a
      # single Linux runner via `bun build --compile --target=…`. The
      # asset-upload step (scripts/package-client-release.sh) invokes it;
      # changesets/action above only needs Node.
      - name: Set up Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.2.20

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # When pending changesets exist, this opens / refreshes the
      # "Version Packages" PR. When that PR merges (no pending changesets
      # remain), the publish step runs `pnpm changeset tag` which creates
      # the local `@vicoop-bridge/client@<version>` tag; the action then
      # pushes that tag and creates the GitHub release object using the
      # CHANGELOG entry as the body. Asset files are attached in the
      # following step.
      - name: Version PR or tag client release
        id: changesets
        uses: changesets/action@v1
        with:
          version: pnpm changeset version
          publish: pnpm changeset tag
          commit: 'chore: version packages'
          title: 'chore: version packages'
          createGithubReleases: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      # The script is idempotent: it reads the current client version
      # from package.json, looks up the matching release, and exits
      # cheaply when assets are already complete or the release doesn't
      # exist yet. Running unconditionally lets a workflow_dispatch
      # rerun recover from a failure between release creation and asset
      # upload, where `changeset tag` on rerun would otherwise produce
      # no `published` signal.
      - name: Upload client release assets
        run: ./scripts/upload-client-release-assets.sh
        env:
          # Baked into the cross-compiled client binaries at build time so
          # opt-in crash telemetry has somewhere to report. A Sentry DSN is a
          # submit-only credential (safe to ship in a public binary); it's kept
          # as a secret here only so it stays out of CI logs. Unset (e.g. forks
          # without the secret) → binaries build with telemetry disabled.
          VICOOP_CLIENT_SENTRY_DSN: ${{ secrets.VICOOP_CLIENT_SENTRY_DSN }}