t3-code-android-nightly/.repos/alchemy-effect/.github/workflows/release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: >-
          Release spec. `beta` (the default) publishes the next
          `2.0.0-beta.N`; `beta.N` publishes that exact candidate. `rc[.N]`
          and `alpha[.N]` select those prerelease channels.
          `patch|minor|major` or `x.y.z` publishes a stable release. Anything
          else publishes `0.0.0-<name>`.
        required: false
        type: string
        default: "beta"
      force-latest:
        description: Publish the release under the latest dist-tag
        required: false
        type: boolean
        default: true

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: write
  id-token: write

env:
  ALCHEMY_REPO: alchemy-run/alchemy

jobs:
  build:
    name: Build and pack
    runs-on: blacksmith-8vcpu-ubuntu-2404
    outputs:
      sha: ${{ steps.commit.outputs.sha }}
      tag: ${{ steps.release.outputs.tag }}
      version: ${{ steps.release.outputs.version }}
      channel: ${{ steps.release.outputs.channel }}
    steps:
      - name: Generate bot token
        id: bot-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ secrets.ALCHEMY_VERSION_BOT_ID }}
          private-key: ${{ secrets.ALCHEMY_VERSION_BOT_PRIVATE_KEY }}

      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          token: ${{ steps.bot-token.outputs.token }}

      - name: Checkout distilled
        run: git submodule update --init --depth=1 --checkout -- submodules/distilled

      - name: Restore Turbo cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: .turbo
          key: turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-${{ github.workflow }}-${{ github.run_attempt }}
          restore-keys: |
            turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-
            turbo-${{ runner.os }}-${{ github.repository_id }}-

      - name: Setup pnpm, Node.js, Bun and install dependencies
        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
        with:
          cache: true
          install: true
          require-lockfile: true

      - id: release
        name: Prepare release
        env:
          FORCE_LATEST: ${{ inputs.force-latest }}
        run: |
          set -euo pipefail
          bun scripts/release/prepare.ts '${{ inputs.version }}' | tee -a "$GITHUB_OUTPUT"

      - name: Build release packages
        # Match preview CI: the cold tsgo build can starve the runner
        # without Go heap limits on this 32 GB machine.
        env:
          GOMEMLIMIT: 6GiB
          GOGC: "40"
        run: >-
          pnpm turbo run build
          $(jq -r '.[] | "--filter=\(.name)"' release-packages.json)

      - name: Pack release artifacts
        run: |
          set -euo pipefail
          mkdir release-packages
          while IFS= read -r dir; do
            pnpm --dir "$dir" pack --pack-destination "$GITHUB_WORKSPACE/release-packages"
          done < <(jq -r '.[].dir' release-packages.json)

      - id: commit
        name: Commit and tag
        env:
          VERSION: ${{ steps.release.outputs.version }}
          CHANNEL: ${{ steps.release.outputs.channel }}
          GITHUB_TOKEN: ${{ github.token }}
        run: bash scripts/release/commit.sh

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-packages
          path: release-packages/*.tgz
          if-no-files-found: error
          retention-days: 7

  publish:
    name: Publish
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.build.outputs.sha }}
          fetch-depth: 0

      - name: Checkout distilled
        run: git submodule update --init --depth=1 --checkout -- submodules/distilled

      - name: Setup pnpm, Node.js, Bun
        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
        with:
          cache: true
          install: false

      # Release scripts import changelogithub, but publishing does not need
      # package lifecycle scripts or the root Turbo-backed prepare build.
      - name: Install dependencies
        run: pnpm install --frozen-lockfile --ignore-scripts

      - name: Remove token-based npm authentication
        run: sed -i '/always-auth/d' ~/.npmrc 2>/dev/null || true

      - name: Download release artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: release-packages
          path: release-packages

      - name: Publish tarballs with OIDC
        env:
          PUBLISH_TAG: ${{ needs.build.outputs.tag }}
          CHANNEL_TAG: ${{ needs.build.outputs.channel == 'release' && 'latest' || needs.build.outputs.channel == 'tag' && needs.build.outputs.tag || 'next' }}
          FORCE_LATEST: ${{ inputs.force-latest }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: bash scripts/release/publish.sh

      - name: Create GitHub release
        if: needs.build.outputs.channel != 'tag'
        env:
          GITHUB_TOKEN: ${{ github.token }}
          VERSION: ${{ needs.build.outputs.version }}
          CHANNEL: ${{ needs.build.outputs.channel }}
        run: bun scripts/release/github-release.ts "v${VERSION}" "$CHANNEL"

      - name: Notify Discord
        if: needs.build.outputs.channel != 'tag'
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK_URL }}
          VERSION: ${{ needs.build.outputs.version }}
          CHANNEL: ${{ needs.build.outputs.channel }}
        run: bun scripts/release/discord-notify.ts "v${VERSION}" "$CHANNEL"