release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Release version (e.g., v1.0.0)'
        required: true
        type: string
  release:
    types: [published]
  push:
    tags:
      - 'v*'

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: '10.15.0'

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install

      - name: Run quality checks
        run: pnpm quality-gate

      - name: Build all packages
        run: pnpm build

      - name: Determine version
        id: version
        run: |
          if [ -n "${{ github.event.inputs.version }}" ]; then
            VERSION="${{ github.event.inputs.version }}"
          elif [ -n "${{ github.event.release.tag_name }}" ]; then
            VERSION="${{ github.event.release.tag_name }}"
          elif [[ $GITHUB_REF == refs/tags/* ]]; then
            VERSION="${GITHUB_REF#refs/tags/}"
          else
            echo "Error: Could not determine version"
            exit 1
          fi
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "VERSION=$VERSION" >> $GITHUB_ENV

      - name: Create manual release artifacts
        run: |
          chmod +x scripts/package-manual.sh
          ./scripts/package-manual.sh ${{ steps.version.outputs.version }}

      - name: Upload release artifacts as workflow artifacts
        uses: actions/upload-artifact@v4
        with:
          name: pair-cli-manual-${{ steps.version.outputs.version }}
          path: |
            release/pair-cli-manual-${{ steps.version.outputs.version }}.zip
            release/pair-cli-manual-${{ steps.version.outputs.version }}.zip.sha256
          retention-days: 30

      - name: Smoke-test packaged artifact (verify checksum and run --version)
        run: |
          set -euo pipefail
          V=${{ steps.version.outputs.version }}
          ZIP=release/pair-cli-manual-${V}.zip
          SUM=release/pair-cli-manual-${V}.zip.sha256

          if [ ! -f "$ZIP" ]; then
            echo "Error: artifact $ZIP not found"
            exit 1
          fi
          if [ ! -f "$SUM" ]; then
            echo "Error: checksum $SUM not found"
            exit 1
          fi

          # Verify checksum (use sha256sum if present, else shasum)
          if command -v sha256sum >/dev/null 2>&1; then
            calc=$(sha256sum "$ZIP" | awk '{print $1}')
          else
            calc=$(shasum -a 256 "$ZIP" | awk '{print $1}')
          fi
          expected=$(cat "$SUM" | tr -d '\n' | tr -d '\r')
          if [ "$calc" != "$expected" ]; then
            echo "Error: checksum mismatch (expected $expected, got $calc)"
            exit 1
          fi

          TMPDIR=$(mktemp -d)
          unzip -q "$ZIP" -d "$TMPDIR"
          ART_DIR="$TMPDIR/pair-cli-manual-${V}"
          if [ ! -d "$ART_DIR" ]; then
            echo "Error: extracted artifact directory not found: $ART_DIR"
            ls -la "$TMPDIR"
            exit 1
          fi

          # Try running top-level wrapper first, else call node directly
          if [ -x "$ART_DIR/pair-cli" ]; then
            "$ART_DIR/pair-cli" --version || true
          elif [ -x "$ART_DIR/bin/pair-cli" ]; then
            "$ART_DIR/bin/pair-cli" --version || true
          elif [ -f "$ART_DIR/bundle-cli/index.js" ]; then
            node "$ART_DIR/bundle-cli/index.js" --version || true
          else
            echo "Warning: no runnable binary found in artifact to smoke-test"
          fi

          echo "Smoke-test completed (exit codes may be non-zero for CLI version checks if the bundle returns non-zero); proceed with release if tests are acceptable."

      - name: Create GitHub Release
        id: create_release
        if: github.event_name != 'workflow_dispatch' || github.event.inputs.version != ''
        uses: actions/create-release@v1
        with:
          tag_name: ${{ steps.version.outputs.version }}
          release_name: Release ${{ steps.version.outputs.version }}
          body: |
            ## Manual Installation Artifacts

            This release includes bundled artifacts for manual installation in air-gapped or restricted environments.

            ### Downloads
            - **ZIP Archive**: `pair-cli-manual-${{ steps.version.outputs.version }}.zip`
            - **SHA256 Checksum**: `pair-cli-manual-${{ steps.version.outputs.version }}.zip.sha256`

            ### Installation Instructions

            1. Download the ZIP archive
            2. Verify the checksum: `sha256sum pair-cli-manual-${{ steps.version.outputs.version }}.zip`
            3. Extract the archive
            4. Run the executable: `./pair-cli --help`

            ### What's Included
            - Self-contained Node.js bundle (no external dependencies required)
            - Cross-platform executables (Linux/macOS/Windows)
            - TypeScript definitions
            - Configuration files
            - Documentation and license

            For more details, see [RELEASE.md](docs/RELEASE.md) and [CLI README](apps/pair-cli/README.md).
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload release assets to the created release
        if: github.event_name != 'workflow_dispatch' || github.event.inputs.version != ''
        uses: actions/upload-release-asset@v1
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url || env.RELEASE_UPLOAD_URL }}
          asset_path: release/pair-cli-manual-${{ steps.version.outputs.version }}.zip
          asset_name: pair-cli-manual-${{ steps.version.outputs.version }}.zip
          asset_content_type: application/zip
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload checksum to the release
        if: github.event_name != 'workflow_dispatch' || github.event.inputs.version != ''
        uses: actions/upload-release-asset@v1
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url || env.RELEASE_UPLOAD_URL }}
          asset_path: release/pair-cli-manual-${{ steps.version.outputs.version }}.zip.sha256
          asset_name: pair-cli-manual-${{ steps.version.outputs.version }}.zip.sha256
          asset_content_type: text/plain
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}