headroom/.github/workflows/release.yml

name: Release

# ─── Package Registry Configuration ────────────────────────────────────────────
# Edit these constants to change package names, environments, and registries.
# All values are referenced via ${{ env.VAR }} throughout the workflow.
env:
  # PyPI
  PYPI_PACKAGE: headroom-ai
  PYPI_ENVIRONMENT: pypi

  # npm (npmjs.org)
  NPM_REGISTRY_URL: https://registry.npmjs.org
  NPM_SDK_PACKAGE: headroom-ai
  NPM_OPENCLAW_PACKAGE: headroom-openclaw

  # GitHub Package Registry
  GITHUB_PACKAGES_REGISTRY_URL: https://npm.pkg.github.com

  # ─── Safety Gates ──────────────────────────────────────────────────────────────
  # Set to 'true' to skip a publish target (e.g., when tokens are not configured).
  # In GitHub: repo Settings → Variables → Actions Variables → New repository variable.
  # Locally via act: pass -e event.yml or set in .actrc.local (see .actrc.example).
  PYPI_SKIP: "false"
  NPM_SKIP: "false"
  GITHUB_PKG_SKIP: "false"

on:
  push:
    branches: [main]
    paths-ignore:
      - "docs/**"
      - ".github/workflows/ci.yml"
      - ".github/workflows/publish.yml"
      - "scripts/**"
      - ".commitlintrc.json"
      - ".actrc"
      - ".actrc.local.example"
      - ".env.act.example"
      - ".github/act/**"
  workflow_dispatch:
    inputs:
      version:
        description: "Manual version override"
        required: false
      dry_run:
        description: "Skip publish"
        type: boolean
        default: false

jobs:
  detect-version:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.ver.outputs.version }}
      npm_version: ${{ steps.ver.outputs.npm_version }}
      canonical: ${{ steps.ver.outputs.canonical }}
      height: ${{ steps.ver.outputs.height }}
      bump: ${{ steps.ver.outputs.bump }}
      previous_tag: ${{ steps.ver.outputs.previous_tag }}
      commit_message: ${{ steps.bump.outputs.commit_message }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Detect bump level
        id: bump
        run: |
          python - <<'PYEOF'
          import subprocess, os, re

          msg = subprocess.run(["git", "log", "-1", "--format=%s"], capture_output=True, text=True, check=False).stdout.strip()
          body = subprocess.run(["git", "log", "-1", "--format=%B"], capture_output=True, text=True, check=False).stdout.strip()

          is_major = bool(re.search(r'^feat!', msg)) or "BREAKING CHANGE" in body
          is_minor = bool(re.search(r'^feat:', msg)) and not is_major
          level = "major" if is_major else ("minor" if is_minor else "patch")

          with open(os.environ["GITHUB_OUTPUT"], "a") as f:
              f.write(f"commit_message={msg}\n")
              f.write(f"level={level}\n")
          PYEOF

      - name: Compute version from canonical + commit height
        id: ver
        run: |
          python - <<'PYEOF'
          import subprocess, os, re, tomllib

          with open("pyproject.toml", "rb") as f:
              data = tomllib.load(f)
          canonical = data["project"]["version"]
          major, minor, patch = map(int, re.match(r"(\d+)\.(\d+)\.(\d+)", canonical).groups())

          level = os.environ.get("LEVEL", "patch")
          manual = os.environ.get("MANUAL_VER", "")

          if manual:
              new_ver = manual
              bump = "manual"
              npm_ver = manual
              canonical_out = ""
              height_out = "0"
              previous_tag_out = ""
          else:
              # Find last tag matching v{canonical}.*
              tag_prefix = f"v{canonical}."
              tag_result = subprocess.run(
                  ["git", "tag", "-l", f"{tag_prefix}*"],
                  capture_output=True, text=True, check=False
              )
              tags = [t.strip() for t in tag_result.stdout.strip().split("\n") if t.strip()]

              if tags:
                  # Sort by version number, get highest
                  def parse_tag(t):
                      v = t.lstrip("v")
                      parts = re.match(r"(\d+)\.(\d+)\.(\d+)\.(\d+)", v)
                      return tuple(int(x) for x in parts.groups()) if parts else (0, 0, 0, 0)
                  tags.sort(key=parse_tag, reverse=True)
                  last_tag = tags[0]
                  prev_height = int(last_tag.rsplit(".", 1)[-1])

                  # Count commits since the last tagged release
                  count_result = subprocess.run(
                      ["git", "rev-list", f"{last_tag}..HEAD", "--count"],
                      capture_output=True, text=True, check=False
                  )
                  height = int(count_result.stdout.strip())
              else:
                  # No prior tag at this canonical level — height = 0
                  prev_height = 0
                  height = 0

              # Determine bump
              if level == "major":
                  new_ver = f"{major + 1}.0.0.0"
                  npm_ver = f"{major + 1}.0.0"
              elif level == "minor":
                  new_ver = f"{major}.{minor + 1}.0.0"
                  npm_ver = f"{major}.{minor + 1}.0"
              else:  # patch
                  new_ver = f"{canonical}.{prev_height + 1}"
                  npm_ver = f"{major}.{minor}.{patch + 1}"

              bump = level

          with open(os.environ["GITHUB_OUTPUT"], "a") as f:
              f.write(f"version={new_ver}\n")
              f.write(f"npm_version={npm_ver}\n")
              f.write(f"canonical={canonical_out if manual else canonical}\n")
              f.write(f"height={height_out if manual else height}\n")
              f.write(f"bump={bump}\n")
              f.write(f"previous_tag={previous_tag_out if manual else (last_tag if tags else '')}\n")
          PYEOF
        env:
          LEVEL: ${{ steps.bump.outputs.level }}
          MANUAL_VER: ${{ github.event.inputs.version }}

  build:
    needs: [detect-version]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Sync version to package files
        run: |
          python scripts/version-sync.py --version ${{ needs.detect-version.outputs.npm_version }}

      - name: Run changelog generation
        run: |
          PREV_TAG="${{ needs.detect-version.outputs.previous_tag }}"
          if [ -n "$PREV_TAG" ]; then
            python scripts/changelog-gen.py \
              --version ${{ needs.detect-version.outputs.version }} \
              --since "$PREV_TAG"
          else
            python scripts/changelog-gen.py \
              --version ${{ needs.detect-version.outputs.version }}
          fi

      - name: Show changelog
        run: cat .changelog.md

      - name: Upload changelog artifact
        uses: actions/upload-artifact@v4
        with:
          name: changelog
          path: .changelog.md

      - name: Build Python package
        run: python -m pip install build wheel && python -m build

      - name: Upload dist artifact
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  publish-pypi:
    needs: [build]
    if: github.event.inputs.dry_run != 'true' && vars.PYPI_SKIP != 'true'
    environment: pypi  # NOTE: environment name must be a literal; update here if the GitHub environment name changes
    runs-on: ubuntu-latest
    permissions:
      id-token: write  # Required for OIDC trusted publishing
    steps:
      - name: Download dist artifact
        uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/

      - name: Publish ${{ env.PYPI_PACKAGE }} to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1

  publish-npm:
    needs: [build]
    if: github.event.inputs.dry_run != 'true' && vars.NPM_SKIP != 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          registry-url: ${{ env.NPM_REGISTRY_URL }}

      - name: Download dist artifact
        uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/

      - name: Publish ${{ env.NPM_SDK_PACKAGE }} (TypeScript SDK) to npmjs.org
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          cd sdk/typescript
          npm install
          npm run build
          npm version ${{ needs.detect-version.outputs.npm_version }} --no-git-tag-version
          npm publish --access public

      - name: Publish ${{ env.NPM_OPENCLAW_PACKAGE }} to npmjs.org
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          cd plugins/openclaw
          npm install
          npm run build
          npm version ${{ needs.detect-version.outputs.npm_version }} --no-git-tag-version
          npm publish --access public

  publish-github-packages:
    needs: [build]
    if: github.event.inputs.dry_run != 'true' && vars.GITHUB_PKG_SKIP != 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Node.js for GitHub Package Registry
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          registry-url: ${{ env.GITHUB_PACKAGES_REGISTRY_URL }}

      - name: Download dist artifact
        uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/

      - name: Publish ${{ env.NPM_OPENCLAW_PACKAGE }} to GitHub Package Registry
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          cd plugins/openclaw
          npm install
          npm run build
          npm version ${{ needs.detect-version.outputs.npm_version }} --no-git-tag-version
          npm publish --access public --registry ${{ env.GITHUB_PACKAGES_REGISTRY_URL }}

  create-release:
    needs: [detect-version, build]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Download changelog artifact
        uses: actions/download-artifact@v4
        with:
          name: changelog
          path: .

      - name: Create GitHub Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create v${{ needs.detect-version.outputs.version }} \
            --title "Release v${{ needs.detect-version.outputs.version }}" \
            --notes-file .changelog.md