release.yml

name: Release

on:
  repository_dispatch:
    types: [openapi-updated]
  schedule:
    - cron: '0 6 * * *'
  workflow_dispatch:
    inputs:
      version_bump:
        description: 'patch | minor | major'
        required: false
        default: 'patch'
      version:
        description: 'Exact X.Y.Z to release instead of a bump; must be greater than the last release'
        required: false
        default: ''

jobs:
  release:
    runs-on: ubuntu-latest
    environment: release
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@v7
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          # Release tags are the ledger the gate below reads. The default shallow
          # checkout fetches none of them, which would make every run look like a
          # first release.
          fetch-depth: 0

      # An exact version is a deliberate jump the bump cannot express (0.1.x to 1.1.1).
      # Refused before any build when malformed or not above the last release tag.
      - name: Validate the requested version
        if: inputs.version != ''
        env:
          EXACT_VERSION: ${{ inputs.version }}
        run: |
          LAST=$(git tag --list 'v*' --sort=-v:refname | head -1)
          LAST=${LAST#v}
          if ! [[ "$EXACT_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "::error::version must be MAJOR.MINOR.PATCH, got $EXACT_VERSION"
            exit 1
          fi
          if [ "$EXACT_VERSION" = "$LAST" ] || [ "$(printf '%s\n' "$LAST" "$EXACT_VERSION" | sort -V | tail -1)" != "$EXACT_VERSION" ]; then
            echo "::error::version $EXACT_VERSION must be greater than the last release $LAST"
            exit 1
          fi

      - uses: actions/setup-dotnet@v5
        with:
          dotnet-version: |
            8.0.x
            9.0.x

      - name: Install Kiota
        run: |
          dotnet tool install --global Microsoft.OpenApi.Kiota --version 1.34.1
          echo "$HOME/.dotnet/tools" >> "$GITHUB_PATH"

      - name: Regenerate from live spec
        run: dotnet run --project tools/RoxyDevTools -- generate

      # Compare against the last RELEASED tag, never against the working tree.
      # "Did anything change since the last commit" is the wrong question: commit a
      # regeneration by hand and the next run sees a clean tree, reports success and
      # silently skips every publish step below, leaving the registry behind forever.
      # The tag cannot lie, because whatever is published is what that tag built.
      # The spec is the only generator input, so it is the only thing worth diffing;
      # a generator version bump changes the output without touching the spec and is
      # released deliberately through workflow_dispatch.
      - name: Is the published release built from the current spec?
        id: diff
        run: |
          LAST=$(git describe --tags --abbrev=0 --match 'v*' 2>/dev/null || true)
          if [ -z "$LAST" ]; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          git show "$LAST:specs/openapi.json" | jq -cS . > "$RUNNER_TEMP/released-spec.json"
          jq -cS . specs/openapi.json > "$RUNNER_TEMP/current-spec.json"
          if cmp -s "$RUNNER_TEMP/released-spec.json" "$RUNNER_TEMP/current-spec.json"; then
            echo "changed=false" >> "$GITHUB_OUTPUT"
          else
            echo "changed=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Build
        if: steps.diff.outputs.changed == 'true' || github.event_name == 'workflow_dispatch'
        run: dotnet build -c Release

      - name: Test
        if: steps.diff.outputs.changed == 'true' || github.event_name == 'workflow_dispatch'
        run: dotnet test -c Release --no-build
        env:
          ROXY_API_KEY: ${{ secrets.ROXY_API_KEY }}

      - name: Bump version in src/RoxyApi.csproj
        id: bump
        if: steps.diff.outputs.changed == 'true' || github.event_name == 'workflow_dispatch'
        env:
          EXACT_VERSION: ${{ inputs.version }}
        run: |
          python3 - <<'PY'
          import os, re
          bump = "${{ github.event.inputs.version_bump || 'patch' }}"
          path = "src/RoxyApi.csproj"
          text = open(path).read()
          cur = re.search(r"<Version>(.+?)</Version>", text).group(1)
          major, minor, patch = (int(x) for x in cur.split("."))
          if bump == "major":   major, minor, patch = major + 1, 0, 0
          elif bump == "minor": minor, patch = minor + 1, 0
          else:                 patch += 1
          new = os.environ["EXACT_VERSION"] or f"{major}.{minor}.{patch}"
          open(path, "w").write(text.replace(f"<Version>{cur}</Version>", f"<Version>{new}</Version>", 1))
          with open(os.environ["GITHUB_OUTPUT"], "a") as f:
              f.write(f"version={new}\n")
          print(f"Bumped {cur} -> {new} ({bump})")
          PY

      - name: Pack
        if: steps.diff.outputs.changed == 'true' || github.event_name == 'workflow_dispatch'
        run: dotnet pack src/RoxyApi.csproj -c Release -o artifacts

      - name: NuGet login (OIDC, short-lived API key)
        id: login
        if: steps.diff.outputs.changed == 'true' || github.event_name == 'workflow_dispatch'
        uses: NuGet/login@v1
        with:
          user: ${{ secrets.NUGET_USER }}

      - name: Push to NuGet
        if: steps.diff.outputs.changed == 'true' || github.event_name == 'workflow_dispatch'
        run: dotnet nuget push "artifacts/*.nupkg" --api-key "${{ steps.login.outputs.NUGET_API_KEY }}" --source https://api.nuget.org/v3/index.json --skip-duplicate

      - name: Commit, tag, push
        if: steps.diff.outputs.changed == 'true' || github.event_name == 'workflow_dispatch'
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          VERSION=${{ steps.bump.outputs.version }}
          git add specs/openapi.json src/ README.md AGENTS.md docs/llms-full.txt tests/RoxyApi.Tests/Generated
          git commit -m "release: v$VERSION"
          git tag "v$VERSION"
          git push --follow-tags

      - name: Create GitHub release
        if: steps.diff.outputs.changed == 'true' || github.event_name == 'workflow_dispatch'
        uses: softprops/action-gh-release@v3
        with:
          tag_name: v${{ steps.bump.outputs.version }}
          generate_release_notes: true
          make_latest: 'true'
          files: artifacts/*.nupkg