publish.yml

name: Release & Publish

on:
  push:
    branches: [main]
  release:
    types: [created]
  workflow_dispatch:
    inputs:
      publish_version:
        description: "Manually publish this version (e.g. 0.4.1). Skips release-please."
        required: true

permissions:
  contents: read

jobs:
  release-please:
    name: Release Please
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'push' }}
    outputs:
      release_created: ${{ steps.release.outputs['release_created'] }}
      tag_name: ${{ steps.release.outputs['tag_name'] }}
      prs_created: ${{ steps.release.outputs['prs_created'] }}
      pr: ${{ steps.release.outputs['pr'] }}
    steps:
      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: app-token
        with:
          app-id: ${{ secrets.BREPKIT_BOT_APP_ID }}
          private-key: ${{ secrets.BREPKIT_BOT_PRIVATE_KEY }}

      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
        id: release
        # release-please can fail with "duplicate tag" (release already exists)
        # or "issue is locked" (can't comment on auto-merged PR). Both are
        # non-fatal — the release was created successfully. Publishing happens
        # independently via the release:created event trigger.
        continue-on-error: true
        with:
          token: ${{ steps.app-token.outputs.token }}
          manifest-file: .release-please-manifest.json
          config-file: release-please-config.json

  auto-merge:
    name: Auto-merge Release PR
    runs-on: ubuntu-latest
    needs: [release-please]
    if: ${{ needs.release-please.outputs.prs_created == 'true' }}
    steps:
      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: app-token
        with:
          app-id: ${{ secrets.BREPKIT_BOT_APP_ID }}
          private-key: ${{ secrets.BREPKIT_BOT_PRIVATE_KEY }}
      - name: Enable auto-merge
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          PR_NUMBER: ${{ fromJSON(needs.release-please.outputs.pr).number }}
        run: |
          echo "Enabling auto-merge for PR #$PR_NUMBER"
          gh pr merge "$PR_NUMBER" --auto --squash --repo "$GITHUB_REPOSITORY"

  # Publish triggers on three events:
  # 1. release:created — fired when release-please creates a GitHub release
  #    (works even if release-please crashes afterward trying to comment on
  #    the locked/merged PR, which was preventing release_created from being set)
  # 2. release_created output — belt-and-suspenders if release-please succeeds fully
  # 3. workflow_dispatch — manual publish for a specific version
  publish:
    name: Build WASM & Publish
    needs: [release-please]
    if: >-
      always() && (
        github.event_name == 'release' ||
        github.event_name == 'workflow_dispatch' ||
        needs.release-please.outputs.release_created == 'true'
      )
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          registry-url: 'https://registry.npmjs.org'

      # rust-toolchain.toml provides the pinned Rust version + wasm32 target
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2

      - uses: taiki-e/install-action@15449e3094499af05d8d964a1c884208e4b8b595 # v2.62.30
        with:
          tool: wasm-pack

      - name: Build WASM (bundler target for browsers)
        run: wasm-pack build crates/wasm --target bundler --release --out-dir pkg
        env:
          RUSTFLAGS: "-Dwarnings -C target-feature=+simd128"

      - name: Build WASM (nodejs target for Node.js/vitest)
        run: wasm-pack build crates/wasm --target nodejs --release --out-dir pkg-node
        env:
          RUSTFLAGS: "-Dwarnings -C target-feature=+simd128"

      - name: Merge dual targets into single package
        working-directory: crates/wasm
        run: |
          # Rename to .cjs so Node treats it as CommonJS even with "type": "module"
          cp pkg-node/brepkit_wasm.js pkg/brepkit_wasm_node.cjs

      - name: Set package name and exports
        working-directory: crates/wasm/pkg
        run: |
          npm pkg set name="brepkit-wasm"
          node -e '
            const pkg = require("./package.json");
            pkg.main = "brepkit_wasm_node.cjs";
            pkg.module = "brepkit_wasm.js";
            pkg.exports = {
              ".": {
                "node": "./brepkit_wasm_node.cjs",
                "import": "./brepkit_wasm.js",
                "default": "./brepkit_wasm.js"
              },
              "./brepkit_wasm_bg.wasm": "./brepkit_wasm_bg.wasm"
            };
            pkg.files = [...(pkg.files || []), "brepkit_wasm_node.cjs"];
            require("fs").writeFileSync("package.json", JSON.stringify(pkg, null, 2) + "\n");
          '

      - name: Verify version
        working-directory: crates/wasm/pkg
        run: |
          PKG_VERSION=$(jq -r .version package.json)
          TAG_VERSION="${TAG_NAME#v}"
          if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then
            echo "::error::Version mismatch: package.json=$PKG_VERSION tag=$TAG_VERSION"
            exit 1
          fi
          echo "Publishing brepkit-wasm@$PKG_VERSION"
        env:
          TAG_NAME: ${{ github.event.release.tag_name || needs.release-please.outputs.tag_name || format('v{0}', github.event.inputs.publish_version) }}

      - name: Publish to npm (skip if already published)
        working-directory: crates/wasm/pkg
        run: |
          PKG_VERSION=$(jq -r .version package.json)
          if npm view "brepkit-wasm@$PKG_VERSION" version 2>/dev/null; then
            echo "brepkit-wasm@$PKG_VERSION already published — skipping"
            exit 0
          fi
          npm publish --provenance --access public 2>&1 || {
            # Handle race condition: concurrent run published between our check and publish
            if npm view "brepkit-wasm@$PKG_VERSION" version 2>/dev/null; then
              echo "brepkit-wasm@$PKG_VERSION published by concurrent run — skipping"
              exit 0
            fi
            exit 1
          }
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}