release.yml

name: Main Release

on:
  pull_request:
    types: [closed]
    branches:
      - main

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

permissions:
  contents: write

# Serialize runs so concurrent triggers (e.g. a manual retry while a merge-triggered run is
# still in-flight) can't both compute and push the same "chore: release" commit/tag.
concurrency:
  group: release-main
  cancel-in-progress: false

jobs:
  release:
    if: |
      github.event.pull_request.merged == true &&
      (startsWith(github.head_ref, 'release/') || startsWith(github.head_ref, 'hotfix/'))
    runs-on: macos-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          token: ${{ secrets.LICHTBLICK_GITHUB_TOKEN }}
          ref: main
          # Full history is required for the ancestry-based duplicate-release detection below.
          fetch-depth: 0

      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 24

      - name: Enable corepack
        run: corepack enable yarn

      - name: Install dependencies
        run: yarn install --immutable

      - name: Determine version bump type
        id: bump_type
        run: |
          branch_name="$GITHUB_HEAD_REF"
          if [[ "$branch_name" == hotfix/* ]]; then
            echo "type=patch" >> "$GITHUB_ENV"
          elif [[ "$branch_name" =~ ^release/major(/.*)?$ ]]; then
            echo "type=major" >> "$GITHUB_ENV"
          elif [[ "$branch_name" =~ ^release/minor(/.*)?$ ]]; then
            echo "type=minor" >> "$GITHUB_ENV"
          else
            echo "ERROR: Invalid branch name: $branch_name
            Expected one of:
              - hotfix/<name>
              - release/major/<anything>
              - release/minor/<anything>" >&2
            exit 1
          fi

      # See .github/workflows/scripts/check-existing-release.sh for what this detects and why.
      - name: Check for existing release commit
        env:
          # github.ref/github.sha would be the ephemeral pull_request merge-preview ref/commit,
          # which can be stale or gone once the PR is closed. merge_commit_sha is the actual,
          # permanent commit that landed on main.
          MERGE_COMMIT_SHA: ${{ github.event.pull_request.merge_commit_sha }}
        run: bash .github/workflows/scripts/check-existing-release.sh

      - name: Bump root version
        if: env.already_released != 'true'
        run: yarn version ${{ env.type }}

      - name: Bump suite version
        if: env.already_released != 'true'
        working-directory: packages/suite
        run: yarn version ${{ env.type }}

      - name: Get new version
        if: env.already_released != 'true'
        id: get_version
        run: echo "version=$(node -p "require('./package.json').version")" >> $GITHUB_ENV

      - name: Update Sonar version
        if: env.already_released != 'true'
        run: sed -i "" "s/^sonar.projectVersion=.*/sonar.projectVersion=${{ env.version }}/" sonar-project.properties

      - name: Commit and tag
        if: env.already_released != 'true'
        run: |
          git config --global user.name "github-actions[bot]"
          git config --global user.email "github-actions[bot]@users.noreply.github.com"
          git add package.json packages/suite/package.json yarn.lock sonar-project.properties
          git commit -m "chore: release v${{ env.version }} [skip actions]"
          git tag "v${{ env.version }}"
          git push origin main --tags

      # Retry path: the bump/commit/tag already landed on main in a previous attempt.
      # Reset to the exact release commit (not origin/main's tip), in case later
      # commits have since landed on main.
      - name: Use existing release commit
        if: env.already_released == 'true'
        run: |
          git config --global user.name "github-actions[bot]"
          git config --global user.email "github-actions[bot]@users.noreply.github.com"
          git reset --hard "${{ env.release_commit_sha }}"
          git tag -f "v${{ env.version }}"
          git push --force origin "v${{ env.version }}"

      - name: Build prod files
        run: |
          yarn run desktop:build:prod
          yarn run web:build:prod

      - name: Build Windows
        run: yarn run package:win

      - name: Build Linux
        run: yarn run package:linux

      - name: Build macOS
        run: yarn run package:darwin

      - name: Create web static files tarball
        run: tar -czf dist/lichtblick-web.tar.gz -C web/.webpack .

      - name: Create GitHub Release
        uses: ncipollo/release-action@v1
        with:
          tag: "v${{ env.version }}"
          name: "v${{ env.version }}"
          commit: main
          generateReleaseNotes: true
          token: ${{ secrets.LICHTBLICK_GITHUB_TOKEN }}
          artifacts: |
            dist/lichtblick-${{ env.version }}-linux-amd64.deb
            dist/lichtblick-${{ env.version }}-linux-x64.tar.gz
            dist/lichtblick-${{ env.version }}-linux-arm64.deb
            dist/lichtblick-${{ env.version }}-linux-arm64.tar.gz
            dist/lichtblick-${{ env.version }}-mac-universal.dmg
            dist/lichtblick-${{ env.version }}-win.exe
            dist/lichtblick-web.tar.gz
            dist/latest-linux.yml
            dist/latest-mac.yml
            dist/latest.yml

      - name: Trigger SonarCloud analysis
        run: gh workflow run sonarqube.yml --ref main
        env:
          GH_TOKEN: ${{ secrets.LICHTBLICK_GITHUB_TOKEN }}