release.yml

name: Release

on:
  push:
    branches:
      - main

concurrency: ${{ github.workflow }}-${{ github.ref }}

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    environment: release
    permissions:
      contents: write
      packages: write
      pull-requests: write
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: "pnpm"
          registry-url: "https://registry.npmjs.org"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build
        run: pnpm build

      - name: Run tests
        run: pnpm test

      - name: Run typecheck
        run: pnpm typecheck

      - name: Create Release Pull Request or Publish
        id: changesets
        uses: changesets/action@v1
        with:
          publish: pnpm --filter @gh-symphony/cli publish --provenance --access public
          version: pnpm changeset version
          title: "chore: release @gh-symphony/cli"
          commit: "chore: release @gh-symphony/cli"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Capture published version
        if: steps.changesets.outputs.published == 'true'
        id: version
        run: echo "value=$(jq -r '.version' packages/cli/package.json)" >> "$GITHUB_OUTPUT"

      - name: Login to GHCR
        if: steps.changesets.outputs.published == 'true'
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Wait for npm package availability
        if: steps.changesets.outputs.published == 'true'
        run: |
          for attempt in $(seq 1 15); do
            if npm view "@gh-symphony/cli@${{ steps.version.outputs.value }}" version >/dev/null 2>&1; then
              exit 0
            fi

            echo "Package @gh-symphony/cli@${{ steps.version.outputs.value }} is not visible on npm yet (attempt ${attempt}/15)."
            sleep 20
          done

          echo "Timed out waiting for @gh-symphony/cli@${{ steps.version.outputs.value }} to become available on npm."
          exit 1

      - name: Compute image metadata
        if: steps.changesets.outputs.published == 'true'
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=raw,value=latest
            type=raw,value=${{ steps.version.outputs.value }}
            type=sha,format=short,prefix=sha-
          labels: |
            org.opencontainers.image.title=GitHub Symphony
            org.opencontainers.image.description=Official GitHub Symphony headless orchestration image
            org.opencontainers.image.version=${{ steps.version.outputs.value }}

      - name: Build and publish OCI image
        if: steps.changesets.outputs.published == 'true'
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
          push: true
          build-args: |
            INSTALLER_STAGE=installer-registry
            GH_SYMPHONY_VERSION=${{ steps.version.outputs.value }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Smoke test published image
        if: steps.changesets.outputs.published == 'true'
        env:
          IMAGE_REF: ghcr.io/${{ github.repository }}:${{ steps.version.outputs.value }}
        run: |
          docker pull "${IMAGE_REF}"

          TMPDIR="$(mktemp -d)"
          mkdir -p "${TMPDIR}/config/repo"

          cat > "${TMPDIR}/config/repo/WORKFLOW.md" <<'EOF'
          ---
          tracker:
            kind: file
            project_id: smoke-file
            state_field: Status
            active_states:
              - Ready
            terminal_states:
              - Done
          polling:
            interval_ms: 30000
          agent:
            max_concurrent_agents: 1
          codex:
            command: node /app/e2e/stub-worker.js
          ---
          Smoke test workflow.
          EOF

          echo "[]" > "${TMPDIR}/config/issues.json"
          git -C "${TMPDIR}/config/repo" init
          git -C "${TMPDIR}/config/repo" remote add origin https://github.com/smoke-org/smoke-repo.git
          sudo chown -R 1000:1000 "${TMPDIR}/config"

          docker run --rm "${IMAGE_REF}" gh-symphony --version
          docker run --rm \
            -v "${TMPDIR}/config:/var/lib/gh-symphony" \
            -e GH_SYMPHONY_FILE_TRACKER_ISSUES_PATH=/var/lib/gh-symphony/issues.json \
            "${IMAGE_REF}" \
            sh -lc 'cd /var/lib/gh-symphony/repo && gh-symphony repo init && gh-symphony repo start --once'

          default_container="$(docker run -d \
            -v "${TMPDIR}/config:/var/lib/gh-symphony" \
            -e GH_SYMPHONY_FILE_TRACKER_ISSUES_PATH=/var/lib/gh-symphony/issues.json \
            -w /var/lib/gh-symphony/repo \
            "${IMAGE_REF}")"
          trap 'docker rm -f "${default_container}" >/dev/null 2>&1 || true' EXIT
          sleep 5

          if [ "$(docker inspect -f '{{.State.Running}}' "${default_container}")" != "true" ]; then
            docker logs "${default_container}" || true
            status="$(docker inspect -f '{{.State.ExitCode}}' "${default_container}")"
            echo "Expected the image default CMD to keep the orchestrator running; got exit ${status}."
            exit 1
          fi

          docker stop "${default_container}"
          docker rm "${default_container}"
          trap - EXIT

      - name: Tag and create GitHub Release
        if: steps.changesets.outputs.published == 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION="${{ steps.version.outputs.value }}"
          git tag "v$VERSION"
          git push origin "v$VERSION"
          gh release create "v$VERSION" --generate-notes --title "v$VERSION"