release.yaml

---
name: release
run-name: release ${{ github.ref_name }}

on:
  workflow_dispatch:
  release:
    types: [published]

permissions: {}

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      attestations: write
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - name: Reject disallowed branch
        if: >-
          ${{ github.event_name == 'workflow_dispatch'
          && !startsWith(github.ref, 'refs/heads/development/')
          && !startsWith(github.ref, 'refs/heads/hotfix/') }}
        env:
          REF_NAME: ${{ github.ref_name }}
        run: |
          echo "::error::Releases must run from a development/* or" \
            "hotfix/* branch (got $REF_NAME)"
          exit 1

      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Read version from package.json
        id: version
        run: |
          version=$(jq -r .version package.json)
          if [ -z "$version" ] || [ "$version" = "null" ]; then
            echo "::error::No version found in package.json"
            exit 1
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"

      - name: Verify tag matches package.json version
        if: ${{ github.event_name == 'release' }}
        env:
          VERSION: ${{ steps.version.outputs.version }}
          TAG: ${{ github.event.release.tag_name }}
        run: |
          tag=${TAG#v}
          if [ "$tag" != "$VERSION" ]; then
            echo "::error::Release tag $TAG does not match package.json" \
              "version $VERSION"
            exit 1
          fi

      - name: Fail if release already exists
        if: ${{ github.event_name == 'workflow_dispatch' }}
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          if gh release view "$VERSION" --repo "$GITHUB_REPOSITORY" \
              >/dev/null 2>&1; then
            echo "::error::Release $VERSION already exists"
            exit 1
          fi

      - name: Fail if tag already exists
        if: ${{ github.event_name == 'workflow_dispatch' }}
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          if git rev-parse -q --verify "refs/tags/$VERSION" >/dev/null; then
            echo "::error::Tag $VERSION already exists (possibly on a" \
              "different commit); refusing to move it"
            exit 1
          fi

      - name: Install NodeJS
        uses: actions/setup-node@v6
        with:
          node-version: '24'
          cache: yarn

      - name: Install dependencies
        run: yarn install --frozen-lockfile --prefer-offline

      - name: Build
        run: yarn build

      - name: Pack tarball
        run: npm pack --ignore-scripts

      - name: Attest build provenance
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: '*.tgz'

      - name: Upload package artifact
        uses: actions/upload-artifact@v7
        with:
          name: package
          path: '*.tgz'
          if-no-files-found: error
          retention-days: 7

  publish-github:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      packages: write
    steps:
      - name: Download package artifact
        uses: actions/download-artifact@v8
        with:
          name: package

      - name: Install NodeJS
        uses: actions/setup-node@v6
        with:
          node-version: '24'
          registry-url: 'https://npm.pkg.github.com'
          scope: '@scality'

      - name: Publish to GitHub Packages
        env:
          NODE_AUTH_TOKEN: ${{ github.token }}
          VERSION: ${{ needs.build.outputs.version }}
        run: |
          if [ -n "$(npm view "@scality/arsenal@$VERSION" version 2>/dev/null)" ]; then
            echo "::notice::@scality/arsenal@$VERSION already on GitHub Packages; skipping"
          else
            npm publish *.tgz --tag "latest-${VERSION%.*}"
          fi

  publish-npm:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Download package artifact
        uses: actions/download-artifact@v8
        with:
          name: package

      - name: Install NodeJS
        uses: actions/setup-node@v6
        with:
          node-version: '24'
          registry-url: 'https://registry.npmjs.org'
          scope: '@scality'

      - name: Publish to npm
        env:
          VERSION: ${{ needs.build.outputs.version }}
        run: |
          if [ -n "$(npm view "@scality/arsenal@$VERSION" version 2>/dev/null)" ]; then
            echo "::notice::@scality/arsenal@$VERSION already on npm; skipping"
          else
            npm publish *.tgz --provenance --tag "latest-${VERSION%.*}"
          fi

  release:
    needs: [build, publish-github, publish-npm]
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'workflow_dispatch' }}
    permissions:
      contents: write
    steps:
      - name: Create Release
        uses: softprops/action-gh-release@v3
        env:
          GITHUB_TOKEN: ${{ github.token }}
        with:
          name: ${{ needs.build.outputs.version }}
          tag_name: ${{ needs.build.outputs.version }}
          generate_release_notes: true
          append_body: true
          body: |
            GitHub Packages: https://github.com/${{ github.repository }}/pkgs/npm/arsenal
            npm: https://www.npmjs.com/package/@scality/arsenal
          target_commitish: ${{ github.sha }}