ci.yml

name: CI

on:
  pull_request:
    types:
      - opened
      - synchronize
      - reopened
    branches:
      - master
      - main
  push:
    branches:
      - master
      - main

permissions:
  contents: read

jobs:
  test:
    name: Test and coverage
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 24.21.0
          cache: yarn

      - name: Install dependencies
        run: yarn install --frozen-lockfile

      - name: Verify release workflow
        run: node --test scripts/tests/release-workflow.test.cjs

      - name: Run lint and tests with coverage
        run: yarn lint && yarn test:coverage

      - name: Build package
        run: yarn build

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v7
        with:
          files: ./tests/coverage/lcov.info
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: false

  publish:
    name: Publish queued releases
    runs-on: ubuntu-latest
    needs: test
    if: github.event_name == 'push'
    concurrency:
      group: publish-${{ github.repository }}-${{ github.ref_name }}
      cancel-in-progress: false
    permissions:
      contents: write
      id-token: write
      pull-requests: read
    env:
      # Select the public registry without generating a token-based .npmrc.
      NPM_CONFIG_REGISTRY: https://registry.npmjs.org/

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 24.21.0
          cache: yarn

      - name: Drain merged release PRs
        shell: bash
        run: |
          set -euo pipefail

          package_name="$(node -p "require('./package.json').name")"
          base_branch="${GITHUB_REF_NAME}"
          release_head="${GITHUB_SHA}"
          published_version="$(npm view "$package_name" version 2>/dev/null || true)"
          auth_header="$(
            node -e "process.stdout.write('AUTHORIZATION: basic ' + Buffer.from('x-access-token:' + process.env.GITHUB_TOKEN).toString('base64'))"
          )"

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git fetch origin "$base_branch" --tags --force

          # Older PRs were already shipped by the legacy release workflow.
          release_baseline="$(git log "$release_head" --first-parent -n 1 --format=%H --extended-regexp --grep='^chore\(release\): .*Release v[^ ]+ for #[0-9]+$')"
          if [ -z "$release_baseline" ]; then
            echo "Cannot determine the historical release baseline."
            exit 1
          fi

          is_queued_release() {
            git merge-base --is-ancestor "$1" "$release_head" &&
              ! git merge-base --is-ancestor "$1" "$release_baseline"
          }

          create_release_tag() {
            # Tag an existing remote commit; do not manufacture historical workflows.
            git tag -a "$tag" "$merge_commit" -m "Release v${next_version} for #${pr_number}"
          }

          max_version() {
            node - "$1" "$2" <<'NODE'
          const [left, right] = process.argv.slice(2);
          const parse = (value) => {
            if (!value) return [0, 0, 0];
            const parts = value.split('.').map(Number);
            if (parts.length !== 3 || parts.some((part) => !Number.isInteger(part))) {
              throw new Error(`Unsupported npm version: ${value}`);
            }
            return parts;
          };
          const compare = (a, b) => {
            for (let index = 0; index < 3; index += 1) {
              if (a[index] !== b[index]) return a[index] - b[index];
            }
            return 0;
          };
          process.stdout.write(compare(parse(left), parse(right)) >= 0 ? (left || '0.0.0') : (right || '0.0.0'));
          NODE
          }

          bump_version() {
            node - "$1" "$2" <<'NODE'
          const [version, bump] = process.argv.slice(2);
          const parts = version.split('.').map(Number);
          if (parts.length !== 3 || parts.some((part) => !Number.isInteger(part))) {
            throw new Error(`Unsupported npm version: ${version}`);
          }
          if (bump === 'patch') parts[2] += 1;
          if (bump === 'minor') {
            parts[1] += 1;
            parts[2] = 0;
          }
          if (bump === 'major') {
            parts[0] += 1;
            parts[1] = 0;
            parts[2] = 0;
          }
          process.stdout.write(parts.join('.'));
          NODE
          }

          release_for_pr() {
            local pr_number="$1"
            local tag subject release_commit version

            while IFS= read -r tag; do
              release_commit="$(git rev-parse "${tag}^{commit}")"
              subject="$(git for-each-ref --format='%(contents:subject)' "refs/tags/${tag}")"
              if ! [[ "$subject" =~ ^Release\ v([^[:space:]]+)\ for\ \#${pr_number}$ ]]; then
                subject="$(git show -s --format=%s "$release_commit")"
              fi

              if [[ "$subject" =~ Release\ v([^[:space:]]+)\ for\ \#${pr_number}$ ]]; then
                version="${BASH_REMATCH[1]}"
                printf '%s\t%s\t%s\n' "$tag" "$version" "$release_commit"
                return 0
              fi
            done < <(git tag --list 'v*')

            return 1
          }

          ensure_github_release() {
            local pr_json="$1"
            local tag="$2"
            local version="$3"
            local bump="$4"
            local pr_number pr_title pr_body pr_url head_branch release_notes

            pr_number="$(jq -r '.number' <<< "$pr_json")"
            pr_title="$(jq -r '.title' <<< "$pr_json")"
            pr_body="$(jq -r '.body // ""' <<< "$pr_json")"
            pr_url="$(jq -r '.url' <<< "$pr_json")"
            head_branch="$(jq -r '.headRefName' <<< "$pr_json")"
            release_notes="$(mktemp)"

            {
              echo "## Changes"
              echo
              printf -- "- %s\n" "$pr_title"
              echo
              echo "## Release details"
              echo
              printf -- "- npm: https://www.npmjs.com/package/%s/v/%s\n" "$package_name" "$version"
              printf -- "- Pull request: %s\n" "$pr_url"
              printf -- "- Source branch: \`%s\`\n" "$head_branch"
              printf -- "- Version bump: \`%s\`\n" "$bump"
            } > "$release_notes"

            if [ -n "$pr_body" ]; then
              {
                echo
                echo "## Pull request notes"
                echo
                printf '%s\n' "$pr_body" | sed '/^------$/,$d'
              } >> "$release_notes"
            fi

            if gh release view "$tag" >/dev/null 2>&1; then
              gh release edit "$tag" --title "$tag" --notes-file "$release_notes"
            else
              gh release create "$tag" --verify-tag --title "$tag" --notes-file "$release_notes"
            fi
          }

          sync_package_version() {
            local version attempt
            version="$(npm view "$package_name" dist-tags.latest)"
            version="$(max_version "$published_version" "$version")"
            for attempt in 1 2 3; do
              git fetch origin "$base_branch"
              git checkout --detach FETCH_HEAD
              node - "$version" "$package_name" <<'NODE'
            const fs = require('node:fs');
            const version = process.argv[2];
            const manifest = JSON.parse(fs.readFileSync('package.json', 'utf8'));
            if (manifest.name !== process.argv[3]) {
              throw new Error(`Package name changed from ${process.argv[3]} to ${manifest.name}; refusing version synchronization`);
            }
            const parse = (value) => {
              if (!/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(value)) {
                throw new Error(`Unsupported release version: ${value}`);
              }
              return value.split('.').map(Number);
            };
            const current = parse(manifest.version);
            const published = parse(version);
            const different = current.findIndex((part, index) => part !== published[index]);
            if (different !== -1 && current[different] > published[different]) {
              throw new Error(`Refusing to downgrade ${manifest.version} to ${version}`);
            }
            if (manifest.version !== version) {
              manifest.version = version;
              fs.writeFileSync('package.json', JSON.stringify(manifest, null, 2) + '\n');
            }
          NODE
              if git diff --quiet -- package.json; then
                return 0
              fi
              git add package.json
              # Do not match the historical "Release v... for #..." baseline.
              git commit -m "chore(release): 🔖 Sync package version to v${version}"
              if git -c "http.https://github.com/.extraheader=$auth_header" push origin "HEAD:refs/heads/${base_branch}"; then
                return 0
              fi
              echo "Version sync push failed; retrying from the latest remote commit (${attempt}/3)."
            done
            echo "Could not synchronize package.json after three attempts."
            return 1
          }

          prs_json="$(
            gh pr list \
              --repo "$GITHUB_REPOSITORY" \
              --state merged \
              --base "$base_branch" \
              --limit 1000 \
              --json number,title,body,url,headRefName,mergeCommit,mergedAt
          )"

          mapfile -t release_prs < <(
            jq -c '
              sort_by(.mergedAt)
              | .[]
              | select(.mergedAt != null)
              | select(.title | startswith("chore(deps):") | not)
              | select(.headRefName | test("^(fix|feat|break)(/|$)"))
            ' <<< "$prs_json"
          )

          for pr_json in "${release_prs[@]}"; do
            pr_number="$(jq -r '.number' <<< "$pr_json")"
            head_branch="$(jq -r '.headRefName' <<< "$pr_json")"
            merge_commit="$(jq -r '.mergeCommit.oid // empty' <<< "$pr_json")"

            case "$head_branch" in
              fix|fix/*)
                bump="patch"
                ;;
              feat|feat/*)
                bump="minor"
                ;;
              break|break/*)
                bump="major"
                ;;
              *)
                continue
                ;;
            esac

            if [ -z "$merge_commit" ]; then
              echo "Merged PR #${pr_number} has no merge commit."
              exit 1
            fi
            if ! is_queued_release "$merge_commit"; then
              continue
            fi

            if release_info="$(release_for_pr "$pr_number")"; then
              IFS=$'\t' read -r tag version release_commit <<< "$release_info"

              if npm view "${package_name}@${version}" version >/dev/null 2>&1; then
                echo "PR #${pr_number} already published as ${version}."
              else
                echo "Resuming npm publication for PR #${pr_number} as ${version}."
                git checkout --detach "$release_commit"
                npm version "$version" --no-git-tag-version --allow-same-version
                yarn install --frozen-lockfile
                yarn build
                npm publish --access public --tag latest
                git restore -- package.json
              fi

              published_version="$(max_version "$published_version" "$version")"
              ensure_github_release "$pr_json" "$tag" "$version" "$bump"
              continue
            fi

            git checkout --detach "$merge_commit"
            manifest_version="$(node -p "require('./package.json').version")"
            base_version="$(max_version "$manifest_version" "$published_version")"
            next_version="$(bump_version "$base_version" "$bump")"
            tag="v${next_version}"

            if git rev-parse "refs/tags/${tag}" >/dev/null 2>&1; then
              echo "Tag ${tag} already exists but is not recorded for PR #${pr_number}."
              exit 1
            fi

            npm version "$next_version" --no-git-tag-version
            yarn install --frozen-lockfile
            yarn build

            create_release_tag
            git -c "http.https://github.com/.extraheader=$auth_header" push origin "refs/tags/${tag}"

            npm publish --access public --tag latest
            git restore -- package.json
            published_version="$next_version"
            ensure_github_release "$pr_json" "$tag" "$next_version" "$bump"
          done
          sync_package_version
        env:
          GH_TOKEN: ${{ github.token }}
          GITHUB_TOKEN: ${{ github.token }}