release.yml

name: Release
on:
  push: { branches: [ main ] }
permissions:
  contents: write
  issues: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-test-archive:
    runs-on: macos-26
    outputs:
      archive-name: ${{ steps.archive.outputs.archive-name }}
      version: ${{ steps.get-version.outputs.version }}
      is-main: ${{ steps.check-branch.outputs.is-main }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Setup Xcode
        uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1.7.0
        with:
          xcode-version: latest-stable
      - name: Cache Swift packages
        uses: actions/cache@v5
        with:
          path: |
            .build/checkouts
            .build/repositories
          key: ${{ runner.os }}-swift-6.3-spm-${{ hashFiles('Package.resolved') }}
          restore-keys: |
            ${{ runner.os }}-swift-6.3-spm-
      - name: Build and test
        run: swift test --enable-code-coverage --explicit-target-dependency-import-check error -Xswiftc -require-explicit-sendable
      - name: Upload coverage data
        uses: vapor/swift-codecov-action@d5ea9e9f9fbf6cd7694e19240400288b034e3a08 # v0.3.4
        with:
          codecov_token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: false
          verbose: true
          
      - name: Check if main branch
        id: check-branch
        run: |
          echo "is-main=$([[ "${GITHUB_REF}" == "refs/heads/main" ]] && echo true || echo false)" >>"${GITHUB_OUTPUT}"
      - name: Get version from tags
        id: get-version
        run: |
          LATEST_TAG="$(git describe --tags --abbrev=0 2>/dev/null || echo "0.0.0")"
          echo "Latest tag: ${LATEST_TAG}"
          echo "version=${LATEST_TAG}" >>"${GITHUB_OUTPUT}"

      - name: Create archive (intermediate releases only)
        id: archive
        if: steps.check-branch.outputs.is-main == 'false'
        env:
          VERSION: ${{ steps.get-version.outputs.version }}
        run: |
          BRANCH_NAME="$(echo "${GITHUB_REF#refs/heads/}" | tr '/' '-')"
          ARCHIVE_NAME="passage-${VERSION}-${BRANCH_NAME}-$(git rev-parse --short HEAD).zip"

          zip -r "${ARCHIVE_NAME}" Sources Package.swift Package.resolved README.md LICENSE 2>/dev/null || \
          zip -r "${ARCHIVE_NAME}" Sources Package.swift Package.resolved

          echo "archive-name=${ARCHIVE_NAME}" >>"${GITHUB_OUTPUT}"
          echo "Created archive: ${ARCHIVE_NAME}"
          ls -la "${ARCHIVE_NAME}"
      - name: Upload archive artifact
        if: steps.check-branch.outputs.is-main == 'false'
        uses: actions/upload-artifact@v7
        with:
          name: release-archive
          path: ${{ steps.archive.outputs.archive-name }}
          retention-days: 7

  intermediate-release:
    runs-on: ubuntu-latest
    needs: build-test-archive
    if: needs.build-test-archive.outputs.is-main == 'false'
    steps:
      - name: Download archive
        uses: actions/download-artifact@v8
        with:
          name: release-archive
      - name: List artifacts
        run: |
          echo "Intermediate release artifact:"
          ls -la

  calculate-version:
    runs-on: ubuntu-latest
    needs: build-test-archive
    if: needs.build-test-archive.outputs.is-main == 'true'
    outputs:
      version: ${{ steps.calculate.outputs.version }}
      previous-tag: ${{ steps.calculate.outputs.previous-tag }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Calculate next version
        id: calculate
        run: |
          LATEST_TAG="$(git describe --tags --abbrev=0 2>/dev/null || echo "0.0.0")"

          echo "Latest tag: $LATEST_TAG"
          IFS='.' read -r MAJOR MINOR PATCH <<< "$LATEST_TAG"

          BUMP_TYPE="patch"

          # Get commit messages since last tag
          if git rev-parse "${LATEST_TAG}" >/dev/null 2>&1; then
            COMMITS=$(git log "${LATEST_TAG}..HEAD" --pretty=format:"%s%n%b" 2>/dev/null || echo "")
          else
            COMMITS=$(git log --pretty=format:"%s%n%b" 2>/dev/null || echo "")
          fi

          # Check for breaking changes (highest priority)
          if echo "$COMMITS" | grep -qiE "BREAKING CHANGE"; then
            BUMP_TYPE="major"
          # Check for features
          elif echo "$COMMITS" | grep -qE "^feat(\(.+\))?:"; then
            BUMP_TYPE="minor"
          fi

          # Calculate new version
          case "$BUMP_TYPE" in
            major) NEW_VERSION="$((MAJOR + 1)).0.0" ;;
            minor) NEW_VERSION="${MAJOR}.$((MINOR + 1)).0" ;;
            patch) NEW_VERSION="${MAJOR}.${MINOR}.$((PATCH + 1))" ;;
          esac

          echo "Bump type: ${BUMP_TYPE}"
          echo "New version: ${NEW_VERSION}"
          echo "version=${NEW_VERSION}" >> "${GITHUB_OUTPUT}"
          echo "previous-tag=${LATEST_TAG}" >> "${GITHUB_OUTPUT}"

  public-release:
    runs-on: ubuntu-latest
    needs: [build-test-archive, calculate-version]
    if: needs.build-test-archive.outputs.is-main == 'true'
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Create and push tag
        run: |
          VERSION="${{ needs.calculate-version.outputs.version }}"
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git tag -a "${VERSION}" -m "Release ${VERSION}"
          git push origin "${VERSION}"
      - name: Generate changelog
        env:
          VERSION: ${{ needs.calculate-version.outputs.version }}
          PREVIOUS_TAG: ${{ needs.calculate-version.outputs.previous-tag }}
        run: |
          {
            echo "## What's Changed"
            echo ""
            if git rev-parse "${PREVIOUS_TAG}" >/dev/null 2>&1; then
              git log "${PREVIOUS_TAG}..HEAD" --pretty=format:"* %s"
            else
              git log --pretty=format:"* %s"
            fi
            echo ""
            echo ""
            echo "**Full Changelog**: https://github.com/vapor-community/passage/compare/${PREVIOUS_TAG}...${VERSION}"
          } > RELEASE_NOTES.md
      - name: Create GitHub Release
        env:
          VERSION: ${{ needs.calculate-version.outputs.version }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create "${VERSION}" \
            --title "Release ${VERSION}" \
            --notes-file RELEASE_NOTES.md

      - name: Notify passage-fluent
        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
        with:
          token: ${{ secrets.DEPENDENT_REPOS_PAT }}
          repository: rozd/passage-fluent
          event-type: passage-release
          client-payload: '{"version": "${{ needs.calculate-version.outputs.version }}"}'
      - name: Notify passage-mailgun
        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
        with:
          token: ${{ secrets.DEPENDENT_REPOS_PAT }}
          repository: rozd/passage-mailgun
          event-type: passage-release
          client-payload: '{"version": "${{ needs.calculate-version.outputs.version }}"}'
      - name: Notify passage-imperial
        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
        with:
          token: ${{ secrets.DEPENDENT_REPOS_PAT }}
          repository: rozd/passage-imperial
          event-type: passage-release
          client-payload: '{"version": "${{ needs.calculate-version.outputs.version }}"}'
      - name: Notify passage-webauthn
        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
        with:
          token: ${{ secrets.DEPENDENT_REPOS_PAT }}
          repository: rozd/passage-webauthn
          event-type: passage-release
          client-payload: '{"version": "${{ needs.calculate-version.outputs.version }}"}'

  create-bug-issue:
    runs-on: ubuntu-latest
    needs: build-test-archive
    if: ${{ failure() && needs.build-test-archive.outputs.is-main == 'true' }}
    steps:
      - name: Create Bug Issue
        uses: actions/github-script@v9
        with:
          script: |
            const runUrl = `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
            await github.rest.issues.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              title: `[Bug] Build/Test failed on main branch`,
              body: `## Build Failure on Main Branch\n\nThe build or tests failed on the main branch.\n\n**Workflow Run:** ${runUrl}\n\n**Commit:** ${context.sha}\n\nPlease investigate and fix the issue.`,
              labels: ['bug']
            });