release.yml

name: Release

# concurrency: Ensures that for one branch the workflow is not running multiple
# times at the same time as we will get trouble with the versions and pushes.
concurrency: ci-${{ github.ref }}
on:
  push:
    branches:
     - main
     - 'maintenance/**'
  workflow_dispatch:
    inputs:
      release_type:
        description: 'Release type.'
        required: true
        default: 'patch'
        type: choice
        options:
          - major
          - minor
          - patch
permissions:
  contents: write
env:
  NODE_VERSION: 20
  # https://github.com/actions/runner-images/issues/70
  NODE_OPTIONS: "--max_old_space_size=4096"
  PNPM_VERSION: ^9.4
  NPM_CONFIG_@coremedia:registry: 'https://npm.coremedia.io'

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    timeout-minutes: 20
    if: github.actor != 'coremedia-ci' && github.actor != 'github-action[bot]'
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Manual workflow trigger precondition check
        if: github.event_name == 'workflow_dispatch' && (github.ref != 'refs/heads/main' || startsWith(github.ref, 'maintenance/'))
        run: |
          echo "::error Building a release is only allowed from main- or maintenance- branches!"
          exit 1
      #Make sure the release type is one of the allowed inputs.
      - name: Workflow Dispatch release type check
        if: github.event_name == 'workflow_dispatch' && !(github.event.inputs.release_type == 'major' || github.event.inputs.release_type == 'minor' || github.event.inputs.release_type == 'patch')
        run: |
          echo "Expected a release type due to the manual build execution on main branch."
          echo "Allowed release types are: major, minor, patch"
          exit 1
      - name: Maintenance release type check
        if: github.event_name == 'workflow_dispatch' && startsWith(github.ref, 'maintenance/') && !(github.event.inputs.release_type == 'patch')
        run: |
          echo "For maintenance branches only patch versions are allowed."
          exit 1
      - name: Use Node.js ${{ env.NODE_VERSION }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
      - name: Configure NPM
        run: |
          NPM_AUTH_TOKEN=$(curl -s -H "Accept: application/json" -H "Content-Type:application/json" -X PUT --data '{"name": "${{ secrets.CM_NPM_USER }}", "password": "${{ secrets.CM_NPM_PASSWORD }}"}' https://npm.coremedia.io/-/user/org.couchdb.user:${{ secrets.CM_NPM_USER }} | jq -r .token)
          echo "::add-mask::$NPM_AUTH_TOKEN"
          echo "NPM_AUTH_TOKEN=$NPM_AUTH_TOKEN" >> $GITHUB_ENV
          echo "NPM_CONFIG_//npm.coremedia.io/:_authToken=$NPM_AUTH_TOKEN" >> $GITHUB_ENV

          npm install -g pnpm@${{ env.PNPM_VERSION }}
      - name: Setup Git
        run: |
          git config --global user.name 'coremedia-ci'
          git config --global user.email 'coremedia-ci@coremedia.com'
          git pull
      - name: Install
        run: pnpm install
      - name: "Validate peerDependencies"
        run: pnpm script:validate-peers
      # BY MANUAL TRIGGER ONLY!
      # Set the release version to actual MAJOR.MINOR.PATCH version.
      # If a prerelease is triggered manually, we keep the prerelease version for this workflow.
      - name: Create Release Version
        if: github.event_name == 'workflow_dispatch'
        run: |
          if [ -n "$(git status --porcelain)" ]; then
            git status
            echo "error:: There are unexpected changes in git!";
            exit 1
          fi
          # Also updates .release-version
          next_version=$(pnpm --silent "script:version" --release ${{ github.event.inputs.release_type }} --write)
          echo "Next version: ${next_version}"
          pnpm run setversion ${next_version} --filter=coremedia/* --dependencyVersion=^${next_version}
          git commit -am "ci: Set next release version to: ${next_version}"
          pnpm install --no-frozen-lockfile
          git commit -am "ci: Update pnpm-lock.yaml for version ${next_version}"
      # Set prerelease version.
      # On push, we only want to provide a possible rc, which is testable and maybe already testable by our customers.
      # Make sure to set the dependency versions to the concrete version as prerelease versions are not referenced by semver ranges.
      - name: Create Prerelease Version
        if: github.event_name == 'push'
        # Make sure to not commit anything, which has been changed in one of the previous steps.
        # Update the version, afterwards commit and push.
        run: |
          if [ -n "$(git status --porcelain)" ]; then
            git status
            echo "error:: There are unexpected changes in git!";
            exit 1
          fi
          # Also updates .release-version
          next_version=$(pnpm --silent "script:version" --release-candidate --write)
          echo "Next version: ${next_version}"
          pnpm run setversion ${next_version} --filter=coremedia/* --dependencyVersion=${next_version}
          git commit -am "Set next release-candidate version to: ${next_version}"
          pnpm install --no-frozen-lockfile
          git commit -am "ci: Update pnpm-lock.yaml for version ${next_version}"
      - name: Build
        run: |
          pnpm build
      - name: Lint
        run: pnpm lint
      - name: Test
        run: pnpm jest
      - name: Playwright Tests
        run: pnpm playwright
      - name: TypeDoc
        run: |
          if [ -n "$(git status --porcelain)" ]; then
            git status
            echo "error:: There are unexpected changes in git!";
            exit 1
          fi
          pnpm doc
          git add --all
          git commit -am "doc(typedoc): Update typedoc"
      - name: Install for Production
        run: pnpm install --production
      # Publishes a release candidate with tag "next".
      - name: Publish RC
        if: github.event_name == 'push'
        run: |
          echo '//npm.coremedia.io/:_authToken=${NPM_AUTH_TOKEN}' > .npmrc
          pnpm publishall --registry=https://npm.coremedia.io --no-git-checks --tag next
          git reset --hard
      # Publishes a release with tag "latest"
      - name: Publish Release
        if: github.event_name == 'workflow_dispatch'
        run: |
          echo '//npm.coremedia.io/:_authToken=${NPM_AUTH_TOKEN}' > .npmrc
          pnpm publishall --registry=https://npm.coremedia.io --no-git-checks
          git reset --hard
      - name: Push commits
        run: git push
      - name: Create git tag
        if: github.event_name == 'workflow_dispatch'
        run: |
          git tag $(cat .release-version)
          git push origin $(cat .release-version)