github-release.yml

name: Publish GitHub Release

on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag to publish, for example v0.3.2'
        required: true
        type: string

permissions:
  contents: write

concurrency:
  group: github-release-${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout release tag
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref }}

      - name: Resolve release metadata
        id: release
        shell: bash
        run: |
          set -euo pipefail

          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
            tag="${{ inputs.tag }}"
          else
            tag="${GITHUB_REF_NAME}"
          fi

          if [[ ! "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Release tag must match vX.Y.Z, received: $tag" >&2
            exit 1
          fi

          version="${tag#v}"
          notes_path="docs/plan/releases/release_notes_${tag}.md"

          if [[ ! -f "$notes_path" ]]; then
            echo "Missing release notes: $notes_path" >&2
            exit 1
          fi

          package_version="$(node -p "require('./package.json').version")"
          if [[ "$package_version" != "$version" ]]; then
            echo "package.json version ($package_version) must match tag version ($version)" >&2
            exit 1
          fi

          echo "tag=$tag" >> "$GITHUB_OUTPUT"
          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "notes_path=$notes_path" >> "$GITHUB_OUTPUT"

      - name: Run release policy checks
        run: npm run release:check

      - name: Create or update GitHub Release
        uses: actions/github-script@v7
        env:
          RELEASE_TAG: ${{ steps.release.outputs.tag }}
          RELEASE_VERSION: ${{ steps.release.outputs.version }}
          RELEASE_NOTES_PATH: ${{ steps.release.outputs.notes_path }}
        with:
          script: |
            const fs = require('fs');

            const { owner, repo } = context.repo;
            const tag_name = process.env.RELEASE_TAG;
            const name = `Recall ${tag_name}`;
            const body = fs.readFileSync(process.env.RELEASE_NOTES_PATH, 'utf8');

            try {
              const existing = await github.rest.repos.getReleaseByTag({ owner, repo, tag: tag_name });
              await github.rest.repos.updateRelease({
                owner,
                repo,
                release_id: existing.data.id,
                tag_name,
                name,
                body,
                draft: false,
                prerelease: false,
              });
              core.info(`Updated GitHub Release ${tag_name}`);
            } catch (error) {
              if (error.status !== 404) throw error;
              await github.rest.repos.createRelease({
                owner,
                repo,
                tag_name,
                name,
                body,
                draft: false,
                prerelease: false,
                generate_release_notes: false,
              });
              core.info(`Created GitHub Release ${tag_name}`);
            }