release.yml

name: "Release"

on:
  workflow_dispatch:
    inputs:
      version:
        type: string
        description: "Version number to release (e.g., 1.2.3, 1.2.3rc1, 1.2.0)"
        required: true

permissions:
  contents: read

jobs:
  safety_check:
    runs-on: ubuntu-latest
    environment: release
    steps:
      - name: "Security Check"
        uses: Pycord-Development/execute-whitelist-action@107fcb23ce15f46d7fa11ffceb0d803140d7f220 # v2.2.0
        with:
          whitelisted-github-ids: ${{ vars.ALLOWED_USER_IDS }}
          token: ${{ secrets.GITHUB_TOKEN }}

  pre_config:
    needs: [safety_check]
    outputs:
      branch_name: ${{ steps.determine_vars.outputs.branch_name }}
      is_rc: ${{ steps.determine_vars.outputs.is_rc }}
      version: ${{ steps.determine_vars.outputs.version }}
      previous_tag: ${{ steps.determine_vars.outputs.previous_tag }}
      previous_final_tag: ${{ steps.determine_vars.outputs.previous_final_tag }}
    runs-on: ubuntu-latest
    steps:
      - name: "Checkout Repository"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: "Determine Push Branch"
        id: determine_vars
        env:
          VERSION: ${{ github.event.inputs.version }}
        run: |
          set -euo pipefail
          VALID_VERSION_REGEX='^[0-9]+\.[0-9]+\.[0-9]+(rc[0-9]+)?$'
          if ! [[ $VERSION =~ $VALID_VERSION_REGEX ]]; then
            echo "::error::Invalid version string '$VERSION'. Only releases like 1.2.3 and release candidates like 1.2.3rc1 are supported."
            exit 1
          fi
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          PREVIOUS_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || git describe --tags --abbrev=0 2>/dev/null || true)
          if [[ -z "$PREVIOUS_TAG" ]]; then
            echo "::error::Could not determine previous tag. Ensure at least one tag exists."
            exit 1
          fi
          echo "previous_tag=${PREVIOUS_TAG}" >> $GITHUB_OUTPUT
          PREVIOUS_FINAL_TAG=$(git tag --sort=-v:refname | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' | head -n1 || true)
          if [[ -z "$PREVIOUS_FINAL_TAG" ]]; then
            PREVIOUS_FINAL_TAG=$PREVIOUS_TAG
          fi
          echo "previous_final_tag=${PREVIOUS_FINAL_TAG}" >> $GITHUB_OUTPUT
          MAJOR_MINOR_VERSION=$(echo $VERSION | grep -oE '^[0-9]+\.[0-9]+')
          echo "branch_name=v${MAJOR_MINOR_VERSION}.x" >> $GITHUB_OUTPUT
          if [[ $VERSION == *rc* ]]; then
            echo "is_rc=true" >> $GITHUB_OUTPUT
          else
            echo "is_rc=false" >> $GITHUB_OUTPUT
          fi

  #  branch_protection_rename:
  #    needs: [safety_check]
  #    runs-on: ubuntu-latest
  #    environment: release
  #    env:
  #      GH_TOKEN: ${{ secrets.ADMIN_GITHUB_TOKEN }}
  #    outputs:
  #      master_rule_id: ${{ steps.get_rule_ids.outputs.master_rule_id }}
  #      master_pattern: ${{ steps.get_rule_ids.outputs.master_pattern }}
  #      v_rule_id: ${{ steps.get_rule_ids.outputs.v_rule_id }}
  #      v_pattern: ${{ steps.get_rule_ids.outputs.v_pattern }}
  #    steps:
  #      - name: Set up GitHub CLI
  #        uses: wusatosi/setup-gh@v1.1
  #        with:
  #          token: ${{ secrets.ADMIN_GITHUB_TOKEN }}
  #      - name: Get branch protection rule IDs
  #        id: get_rule_ids
  #        run: |
  #          gh api repos/${{ github.repository }}/branch-protection-rules > rules.json
  #          MASTER_ID=$(jq -r '.[] | select(.pattern == "master") | .id' rules.json)
  #          MASTER_PATTERN=$(jq -r '.[] | select(.pattern == "master") | .pattern' rules.json)
  #          V_ID=$(jq -r '.[] | select(.pattern | test("^v[0-9]+\\.[0-9]+\\.x$")) | .id' rules.json)
  #          V_PATTERN=$(jq -r '.[] | select(.pattern | test("^v[0-9]+\\.[0-9]+\\.x$")) | .pattern' rules.json)
  #          echo "master_rule_id=$MASTER_ID" >> $GITHUB_OUTPUT
  #          echo "master_pattern=$MASTER_PATTERN" >> $GITHUB_OUTPUT
  #          echo "v_rule_id=$V_ID" >> $GITHUB_OUTPUT
  #          echo "v_pattern=$V_PATTERN" >> $GITHUB_OUTPUT
  #      - name: Rename master protection to temp-master
  #        if: ${{ steps.get_rule_ids.outputs.master_rule_id != '' }}
  #        run: |
  #          gh api repos/${{ github.repository }}/branch-protection-rules/${{ steps.get_rule_ids.outputs.master_rule_id }} \
  #            -X PATCH -F pattern="temp-master"
  #      - name: Rename v*.* protection to temp-v
  #        if: ${{ steps.get_rule_ids.outputs.v_rule_id != '' }}
  #        run: |
  #          gh api repos/${{ github.repository }}/branch-protection-rules/${{ steps.get_rule_ids.outputs.v_rule_id }} \
  #            -X PATCH -F pattern="temp-v"

  lib_release:
    needs: [pre_config] # , branch_protection_rename
    runs-on: ubuntu-latest
    environment: release
    env:
      GITHUB_TOKEN: ${{ secrets.ADMIN_GITHUB_TOKEN }}
    steps:
      - name: "Checkout Repository"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          fetch-tags: true
      - name: "Create version branch if missing"
        id: conditional-create-version-branch
        shell: bash
        env:
          VERSION_BRANCH: ${{ needs.pre_config.outputs.branch_name }}
          GITHUB_TOKEN: ${{ secrets.ADMIN_GITHUB_TOKEN }}
        run: |
          git fetch origin
          if ! git show-ref --verify --quiet refs/heads/$VERSION_BRANCH; then
            git checkout -b $VERSION_BRANCH
            git push origin $VERSION_BRANCH -f
          fi
          git checkout $VERSION_BRANCH
      - name: "Setup Python"
        id: python-setup
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.14"
          cache: "pip"
          cache-dependency-path: "requirements/_release.txt"
      - name: "Install Release Dependencies"
        id: python-install
        env:
          REQ_FILE: "requirements/_release.txt"
        shell: bash
        run: |
          python -m pip install --upgrade pip
          pip install setuptools setuptools_scm twine build
          pip install -r $REQ_FILE
      - name: "Prepare and Update CHANGELOG.md"
        id: changelog-update
        shell: bash
        env:
          VERSION: ${{ inputs.version }}
          PREVIOUS_TAG: ${{ needs.pre_config.outputs.previous_tag }}
          PREVIOUS_FINAL_TAG: ${{ needs.pre_config.outputs.previous_final_tag }}
          REPOSITORY: ${{ github.repository }}
          GITHUB_TOKEN: ${{ secrets.ADMIN_GITHUB_TOKEN }}
          BRANCH: ${{ github.ref_name }}
        run: |
          git config user.name "NyuwBot"
          git config user.email "nyuw@aitsys.dev"
          DATE=$(date +'%Y-%m-%d')
          python scripts/release_changelog.py \
            --path CHANGELOG.md \
            --version "$VERSION" \
            --previous-tag "$PREVIOUS_TAG" \
            --previous-final-tag "$PREVIOUS_FINAL_TAG" \
            --branch "$BRANCH" \
            --repository "$REPOSITORY" \
            --date "$DATE"
          git add CHANGELOG.md
          git commit -m "chore(release): update CHANGELOG.md for version $VERSION"
      - name: "Commit and Push Changelog to ${{ github.ref_name }}"
        id: commit-main-branch
        shell: bash
        env:
          VERSION: ${{ inputs.version }}
          GITHUB_TOKEN: ${{ secrets.ADMIN_GITHUB_TOKEN }}
          BRANCH: ${{ github.ref_name }}
        run: |
          git config user.name "NyuwBot"
          git config user.email "nyuw@aitsys.dev"
          git push origin HEAD:$BRANCH -f
      - name: "Push Changelog to Version Branch"
        id: commit-version-branch
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.ADMIN_GITHUB_TOKEN }}
          VERSION_BRANCH: ${{ needs.pre_config.outputs.branch_name }}
        run: |
          git config user.name "NyuwBot"
          git config user.email "nyuw@aitsys.dev"
          git push origin HEAD:$VERSION_BRANCH -f
      - name: "Create Git Tag"
        id: create-git-tag
        shell: bash
        env:
          VERSION: ${{ inputs.version }}
          GITHUB_TOKEN: ${{ secrets.ADMIN_GITHUB_TOKEN }}
        run: |
          git config user.name "NyuwBot"
          git config user.email "nyuw@aitsys.dev"
          git tag v$VERSION -m "Release version $VERSION"
          git push origin v$VERSION -f
      - name: "Verify Version"
        id: python-version-verify
        shell: bash
        run: python -m setuptools_scm
      - name: "Build Package"
        id: python-version-build
        shell: bash
        run: |
          python3 -m build --sdist
          python3 -m build --wheel
      - name: "Create GitHub Release"
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        id: gh-release
        with:
          tag_name: "v${{ inputs.version }}"
          name: "v${{ inputs.version }}"
          generate_release_notes: true
          draft: false
          prerelease: ${{ needs.pre_config.outputs.is_rc }}
          files: |
            dist/*.whl
            dist/*.tar.gz
          token: ${{ secrets.ADMIN_GITHUB_TOKEN }}
          make_latest: true
          repository: ${{ github.repository }}
          target_commitish: ${{ github.ref_name }}

      - name: "Publish package distributions to PyPI"
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        env:
          name: "pypi"
          url: "https://pypi.org/p/py-cord"
        with:
          password: ${{ secrets.PYPI_TOKEN }}
          user: __token__
          attestations: false
          verify-metadata: false

      - name: "Echo release url"
        run: echo "${{ steps.gh-release.outputs.url }}"

  docs_release:
    runs-on: ubuntu-latest
    needs: [lib_release, pre_config]
    environment: release
    steps:
      - name: "Checkout repository"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: "Sync and activate version on Read the Docs"
        env:
          READTHEDOCS_TOKEN: ${{ secrets.READTHEDOCS_TOKEN }}
        run: |
          python3 scripts/release_rtd_versions.py \
            --project pycord \
            --version "${{ needs.pre_config.outputs.version }}" \
            --sync

  #inform_discord:
  #  runs-on: ubuntu-latest
  #  needs: [docs_release, lib_release, pre_config]
  #  environment: release
  #  steps:
  #    - name: "Checkout repository"
  #      uses: actions/checkout@v6
  #      with:
  #        fetch-depth: 0
  #        fetch-tags: true

  #     - name: "Notify Discord"
  #      env:
  #       VERSION: ${{ needs.pre_config.outputs.version }}
  #       PREVIOUS_TAG: ${{ needs.pre_config.outputs.previous_tag }}
  #       PREVIOUS_FINAL_TAG: ${{ needs.pre_config.outputs.previous_final_tag }}
  #       DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
  #       REPOSITORY: ${{ github.repository }}
  #      run: python scripts/discord_release_notification.py

  determine_milestone_id:
    runs-on: ubuntu-latest
    needs: [lib_release, pre_config]
    if: ${{ !contains(needs.pre_config.outputs.version, '-') && false }}
    outputs:
      old_milestone_version: ${{ steps.extract_version.outputs.old_milestone_version }}
      new_milestone_version: ${{ steps.extract_version.outputs.new_milestone_version }}
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    environment: release
    steps:
      - name: "Extract Milestone Version"
        id: extract_version
        run: |
          gh extension install valeriobelli/gh-milestone
          VERSION=${{ needs.pre_config.outputs.version }}
          PREV_MAJOR_MINOR=$(echo $VERSION | awk -F. '{printf "v%d.%d", $1, $2-1}')
          OLD_MILESTONE_VERSION=$(gh milestone list --query "$PREV_MAJOR_MINOR" | grep "#" | awk '{print $2}')
          NEW_MILESTONE_VERSION="v$(echo $VERSION | grep -oE '^[0-9]+\.[0-9]+')"
          echo "old_milestone_version=$OLD_MILESTONE_VERSION" >> $GITHUB_OUTPUT
          echo "new_milestone_version=$NEW_MILESTONE_VERSION" >> $GITHUB_OUTPUT

#  close_milestone:
#    runs-on: ubuntu-latest
#    needs: [determine_milestone_id, pre_config]
#    if: ${{ !contains(needs.pre_config.outputs.version, 'rc') &&
#      endsWith(needs.pre_config.outputs.version, '.0') && false }}
#    environment: release
#    env:
#      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
#    steps:
#      - name: "Checkout Repository"
#        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
#        with:
#          fetch-depth: 0
#          fetch-tags: true
#
#      - name: "Close Milestone"
#        run: |
#          gh extension install valeriobelli/gh-milestone
#          OLD_MILESTONE_ID=$(gh milestone list --query "${{ needs.determine_milestone_id.outputs.old_milestone_version }}" | grep "#" | cut -d' ' -f2 | cut -d '#' -f2)
#          gh milestone edit $OLD_MILESTONE_ID --state closed
#
#      - name: "Create New Milestone"
#        run: |
#          gh extension install valeriobelli/gh-milestone
#          gh milestone create -t "${{ needs.determine_milestone_id.outputs.new_milestone_version }}"

#  branch_protection_restore:
#    runs-on: ubuntu-latest
#    needs: [branch_protection_rename, lib_release, docs_release, inform_discord, determine_milestone_id, close_milestone]
#    environment: release
#    if: always()
#    env:
#      GH_TOKEN: ${{ secrets.ADMIN_GITHUB_TOKEN }}
#    steps:
#      - name: Set up GitHub CLI
#        uses: wusatosi/setup-gh@v1.1
#        with:
#          token: ${{ secrets.ADMIN_GITHUB_TOKEN }}
#      - name: Restore master protection pattern
#        if: ${{ needs.branch_protection_rename.outputs.master_rule_id != '' }}
#        run: |
#          gh api repos/${{ github.repository }}/branch-protection-rules/${{ needs.branch_protection_rename.outputs.master_rule_id }} \
#            -X PATCH -F pattern="${{ needs.branch_protection_rename.outputs.master_pattern }}"
#      - name: Restore v*.* protection pattern
#        if: ${{ needs.branch_protection_rename.outputs.v_rule_id != '' }}
#        run: |
#          gh api repos/${{ github.repository }}/branch-protection-rules/${{ needs.branch_protection_rename.outputs.v_rule_id }} \
#            -X PATCH -F pattern="${{ needs.branch_protection_rename.outputs.v_pattern }}"