production-release.yml

# Triggered by: a release/* → main pull request being merged.
#
# The build only runs after main has the code, so the review on the release-branch PR (enforced
# by main's branch protection) is the gate that controls what ships.
#
# Flow:
# PR merged into main from release/vX.Y.Z
#        │
#        ▼
# compute-release-tag  (read version from package.json on the merge commit)
#        │
#        ▼
# check-release-not-published  (guard: fail if vX.Y.Z release is already published)
#        │
#        ▼
# create-signed-tag  (push vX.Y.Z-signed tag on the merge commit)
#        │
#        ├─► run-release      (Mac)
#        │       uses release_mac.yml
#        │
#        ├─► run-release-linux
#        │       uses release_linux.yml
#        │
#        └─► run-release-win
#                uses release_win.yml

name: Production Release

on:
  pull_request:
    types: [closed]
    branches: [main]

permissions:
  contents: write
  actions: write # required by calculate-and-update-version.yml to re-dispatch CI for the version-bump commit

# Each release PR has a unique number, so concurrent releases for different
# PRs run independently. Re-runs for the same PR queue rather than cancel.
concurrency:
  group: production-release-${{ github.event.pull_request.number }}
  cancel-in-progress: false

jobs:
  compute-release-tag:
    # Only act on merged (not just closed) PRs whose source branch is release/*.
    # Hotfixes follow the same pattern — branch named release/vX.Y.Z.
    if: >
      github.event.pull_request.merged == true &&
      startsWith(github.event.pull_request.head.ref, 'release/')
    runs-on: ubuntu-latest
    outputs:
      release_tag: ${{ steps.compute-tag.outputs.release_tag }}
      signed_tag: ${{ steps.compute-tag.outputs.signed_tag }}
      merge_sha: ${{ steps.compute-tag.outputs.merge_sha }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.pull_request.merge_commit_sha }}
          fetch-depth: 0

      - name: Read version from merged package.json
        id: compute-tag
        run: |
          # The version bump is set on the release branch by bump-release-version.yml
          # before the PR is opened, and lands on main as part of the merged diff.
          # CI just reads what's there.
          VERSION=$(node -p "require('./package.json').version")
          # Git tag is vX.Y.Z-signed (for audit); electron-builder publishes
          # the GitHub Release at the unsuffixed vX.Y.Z.
          echo "release_tag=v${VERSION}" | tee -a "$GITHUB_OUTPUT"
          echo "signed_tag=v${VERSION}-signed" | tee -a "$GITHUB_OUTPUT"
          echo "merge_sha=${{ github.event.pull_request.merge_commit_sha }}" | tee -a "$GITHUB_OUTPUT"

  check-release-not-published:
    needs: compute-release-tag
    uses: ./.github/workflows/check-release-not-published.yml
    with:
      release_tag: ${{ needs.compute-release-tag.outputs.release_tag }}
    secrets: inherit

  create-signed-tag:
    needs: [compute-release-tag, check-release-not-published]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ needs.compute-release-tag.outputs.merge_sha }}
          fetch-depth: 0

      - name: Configure git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Create and push -signed tag on the merge commit
        run: |
          SIGNED_TAG="${{ needs.compute-release-tag.outputs.signed_tag }}"
          # Idempotency: if the workflow is re-run (e.g. cancelled and restarted
          # before the build jobs ran), recreate the tag cleanly. A tag whose
          # release has already been published is rejected upstream by
          # check-release-not-published.yml.
          git tag -d "$SIGNED_TAG" 2>/dev/null || true
          git push origin --delete "$SIGNED_TAG" 2>/dev/null || true
          git tag -a "$SIGNED_TAG" -m "Production Release $SIGNED_TAG"
          git push origin "$SIGNED_TAG"

  ensure-draft-release:
    needs: [compute-release-tag, create-signed-tag]
    uses: ./.github/workflows/ensure-draft-release.yml
    with:
      release_tag: ${{ needs.compute-release-tag.outputs.release_tag }}
    secrets: inherit

  run-release:
    needs: [compute-release-tag, create-signed-tag, ensure-draft-release]
    uses: ./.github/workflows/release_mac.yml
    with:
      tag: ${{ needs.compute-release-tag.outputs.signed_tag }}
    secrets: inherit

  run-release-linux:
    needs: [compute-release-tag, create-signed-tag, ensure-draft-release]
    uses: ./.github/workflows/release_linux.yml
    with:
      tag: ${{ needs.compute-release-tag.outputs.signed_tag }}
    secrets: inherit

  run-release-win:
    needs: [compute-release-tag, create-signed-tag, ensure-draft-release]
    uses: ./.github/workflows/release_win.yml
    with:
      tag: ${{ needs.compute-release-tag.outputs.signed_tag }}
    secrets: inherit

  merge-latest-mac-yml:
    needs: [compute-release-tag, run-release]
    uses: ./.github/workflows/merge-latest-mac-yml.yml
    with:
      tag: ${{ needs.compute-release-tag.outputs.signed_tag }}
    secrets: inherit

  summary:
    needs: [compute-release-tag, run-release, run-release-win, run-release-linux, merge-latest-mac-yml]
    runs-on: ubuntu-latest
    steps:
      - name: Create summary
        run: |
          echo "## Release Created Successfully :rocket:" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Tag:** ${{ needs.compute-release-tag.outputs.signed_tag }}" >> $GITHUB_STEP_SUMMARY
          echo "**PR:** #${{ github.event.pull_request.number }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "The draft GitHub Release for **${{ needs.compute-release-tag.outputs.release_tag }}** is ready." >> $GITHUB_STEP_SUMMARY
          echo "QA: please test the installers on macOS / Windows / Linux." >> $GITHUB_STEP_SUMMARY
          echo "Once QA passes, click **Publish** on the draft release in GitHub." >> $GITHUB_STEP_SUMMARY