release.yml

name: release

# Tag-triggered: `vX.Y.Z` for a release, `vX.Y.Z-<label>.N` (e.g. `v0.1.0-rc.1`)
# for a pre-release. Versioning is manual — pushing the tag is the release
# decision, nothing here bumps a Cargo.toml. See CONTRIBUTING.md#release-process.
on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"
      - "v[0-9]+.[0-9]+.[0-9]+-*"

env:
  CARGO_TERM_COLOR: always

permissions:
  contents: write
  # npm trusted publishing: this job's OIDC token is what authenticates the
  # publish (there is no npm token), and it is what provenance is signed with.
  id-token: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          # git-cliff needs the full commit history (and prior tags) to build
          # the changelog for this release, not just the tagged commit.
          fetch-depth: 0

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32v1-none

      - uses: Swatinem/rust-cache@v2

      # Same command CI runs on every PR, so a tag that reaches this workflow
      # builds the wasm the exact same way it was already verified to build.
      - name: Build wasm
        run: cargo build --target wasm32v1-none --release

      - name: Collect artifacts and hashes
        run: |
          set -euo pipefail
          mkdir -p dist
          cp target/wasm32v1-none/release/*.wasm dist/
          cd dist
          sha256sum *.wasm | tee checksums.txt

      # Renders cliff.toml's "⚠ Breaking changes" group from any commit using
      # a conventional-commit `!` marker or a `BREAKING CHANGE:` footer, so an
      # interface-breaking release is called out in the notes, not just in the
      # diff. `--latest` scopes the changelog to commits since the previous tag.
      - name: Generate changelog
        uses: orhun/git-cliff-action@v4
        id: changelog
        with:
          config: cliff.toml
          args: --latest --strip header
        env:
          OUTPUT: CHANGES.md

      # Everything that can fail for a configuration reason runs before anything
      # is published, and the GitHub Release is created last, so a failed publish
      # never leaves a public release with no packages behind it.
      - name: Setup Node for npm publish
        uses: actions/setup-node@v7
        with:
          node-version: 24
          registry-url: 'https://registry.npmjs.org'
          # A release build must not restore dependencies from a cache that
          # another run could have written.
          package-manager-cache: false

      - name: Build TypeScript bindings
        run: |
          set -euo pipefail
          VERSION="${GITHUB_REF_NAME#v}"
          for p in attest policy-spend program record registry; do
            (
              cd "packages/$p"
              # The committed version may already equal the tag (the first
              # release is v0.1.0 and every package says 0.1.0), which plain
              # `npm version` refuses.
              npm version "$VERSION" --no-git-tag-version --allow-same-version
              npm ci
              npm run build
              # Apache-2.0 requires the licence text to travel with the code.
              cp ../../LICENSE .
            )
          done

      - name: Verify bindings are publishable
        run: ./scripts/check-bindings-publishable.sh

      # Authenticates through the trusted publisher set on each package on
      # npmjs.com (milepost-labs / milepost / release.yml, direct publish
      # allowed). If that is missing or wrong, npm uploads unauthenticated and the
      # publish fails with E404 on that package — still before the GitHub Release
      # is created, so re-running the failed job after fixing it is safe.
      - name: Publish TypeScript bindings to npm
        run: |
          set -euo pipefail
          VERSION="${GITHUB_REF_NAME#v}"
          # A pre-release must never become what `npm install @milepost/<name>`
          # resolves to, so it goes out under `next` instead of `latest`.
          case "$VERSION" in
            *-*) DIST_TAG=next ;;
            *)   DIST_TAG=latest ;;
          esac
          for p in attest policy-spend program record registry; do
            NAME="@milepost/$p"
            # Re-running a release that failed partway must not fail on the
            # packages that already went out on the first attempt.
            if npm view "$NAME@$VERSION" version >/dev/null 2>&1; then
              echo "$NAME@$VERSION is already published, skipping"
              continue
            fi
            (cd "packages/$p" && npm publish --provenance --access public --tag "$DIST_TAG")
          done

      - name: Create release
        uses: softprops/action-gh-release@v3
        with:
          name: ${{ github.ref_name }}
          # A `-` in the tag (e.g. v0.1.0-rc.1) marks a pre-release.
          body_path: CHANGES.md
          prerelease: ${{ contains(github.ref_name, '-') }}
          files: |
            dist/*.wasm
            dist/checksums.txt