ansiblings/.gitea/workflows/release.yml

# Tag-driven release of a single package.
#
#   git tag nopy-v1.2.0 && git push origin nopy-v1.2.0
#   git tag nopy-cube-v1.2.0 && git push origin nopy-cube-v1.2.0
#   git tag keyman-v1.2.0 && git push origin keyman-v1.2.0
#
# The tag is the source of truth for *which* package ships; package.json is the
# source of truth for the version, and the two must agree or the run fails.
#
# Packages that link to each other release dependency-first — `nopy-cube` before
# `nopy` — because the linked version is resolved at pack time. The run refuses
# to publish otherwise.
# A version with a prerelease part (1.2.0-rc.1) publishes under `next` instead
# of `latest`.
#
# Required secrets:
#   NPM_TOKEN        npmjs granular token, read-and-write on @bitsquare/*, 2FA
#                    not required. Expires after 90 days — rotate it.
#   MYGITEA_NPM_TOKEN  Gitea PAT with write:package. The automatic GITEA_TOKEN is
#                    a repo-scoped task token and the package registry rejects it.

name: Release

on:
  push:
    tags:
      - '*-v*'

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest

    env:
      GITEA_REGISTRY: ${{ github.server_url }}/api/packages/${{ github.repository_owner }}/npm/
      GITEA_REGISTRY_TOKEN: ${{ secrets.MYGITEA_NPM_TOKEN || secrets.GITEA_TOKEN }}
      NPMJS_REGISTRY: https://registry.npmjs.org/
      NPMJS_TOKEN: ${{ secrets.NPM_TOKEN }}
      NPMRC: ${{ github.workspace }}/.npmrc-release

    steps:
      - name: Check out
        uses: actions/checkout@v4

      - name: Drop the repo's Gitea scope mapping
        # The committed .npmrc points @bitsquare at Gitea so local work resolves
        # snapshots. It must not survive into a publish job: it is a *project*
        # config, which outranks both the userconfig the steps below write and a
        # `--registry` flag, because `@scope:registry` is more specific than
        # `registry`. Left in place, `pnpm publish --registry <npmjs>` uploads to
        # Gitea and `npm view --registry <npmjs>` answers from Gitea — so the
        # npmjs release silently publishes nowhere and then skips itself.
        # Measured, not assumed. The checkout is disposable; each step below
        # names its registry explicitly anyway.
        run: rm -f .npmrc

      - name: Resolve the release from the tag
        id: target
        run: |
          set -euo pipefail
          tag="${GITHUB_REF#refs/tags/}"
          pkg="${tag%-v*}"
          version="${tag##*-v}"
          dir="packages/${pkg}"

          if [ ! -f "${dir}/package.json" ]; then
            echo "::error::Tag '${tag}' names package '${pkg}', but ${dir}/package.json does not exist."
            exit 1
          fi

          declared=$(node -p "require('./${dir}/package.json').version")
          if [ "$declared" != "$version" ]; then
            echo "::error::Tag '${tag}' asks for ${version}, but ${dir}/package.json declares ${declared}. Bump the manifest and re-tag."
            exit 1
          fi

          name=$(node -p "require('./${dir}/package.json').name")
          case "$version" in
            *-*) dist_tag=next ;;
            *)   dist_tag=latest ;;
          esac

          {
            echo "tag=${tag}"
            echo "dir=${dir}"
            echo "name=${name}"
            echo "version=${version}"
            echo "dist_tag=${dist_tag}"
          } >> "$GITHUB_OUTPUT"

          echo "Releasing ${name}@${version} from ${dir} as '${dist_tag}'."

      - name: Check the required secrets are present
        run: |
          set -euo pipefail
          missing=0
          [ -n "${NPMJS_TOKEN}" ] || { echo "::error::NPM_TOKEN secret is not set."; missing=1; }
          [ -n "${GITEA_REGISTRY_TOKEN}" ] || { echo "::error::No Gitea registry token available."; missing=1; }
          exit "$missing"

      - name: Set up pnpm
        # Version comes from `packageManager` in the root package.json.
        uses: pnpm/action-setup@v4

      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc

      - name: Locate the pnpm store
        id: pnpm-store
        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"

      - name: Restore the pnpm store
        continue-on-error: true
        uses: actions/cache@v4
        with:
          path: ${{ steps.pnpm-store.outputs.path }}
          key: pnpm-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
          restore-keys: pnpm-${{ runner.os }}-

      - name: Install
        run: pnpm install --frozen-lockfile

      - name: Check the linked workspace packages are already released
        env:
          NAME: ${{ steps.target.outputs.name }}
          DIR: ${{ steps.target.outputs.dir }}
        run: |
          set -euo pipefail
          # `pnpm publish` turns `workspace:*` into the version the linked
          # package declares at this commit. If that version is not on the
          # registry yet, the release installs to a broken tree — and npmjs
          # only lets you unpublish for 72 hours. Release the dependency first:
          # nopy-cube, then nopy, then any bundle.
          #
          # npmjs only: it is the irreversible one, and it needs no credentials
          # to read, which this step does not have yet.
          missing=0
          for spec in $(node scripts/linked-deps.mjs "$DIR" | tr ' ' '@'); do
            # Scoped, not `--registry`: `@scope:registry` outranks it, so a bare
            # flag can be silently overridden by any project-level .npmrc.
            if npm view "$spec" version --@bitsquare:registry="$NPMJS_REGISTRY" >/dev/null 2>&1; then
              echo "${spec} is published"
            else
              echo "::error::${NAME} depends on ${spec}, which is not on npmjs. Release it first."
              missing=1
            fi
          done
          exit "$missing"

      - name: Lint
        run: pnpm run lint:ci

      - name: Typecheck
        run: pnpm run typecheck

      - name: Test with coverage
        run: pnpm run test:coverage

      - name: Build
        # Explicit, so the publish steps can skip lifecycle scripts entirely.
        run: pnpm run build

      - name: Verify the packed manifests
        # Packages link to each other with `workspace:*`, which npm cannot
        # install. Proves on the tarball that pack rewrote it.
        run: node scripts/verify-pack.mjs

      - name: Publish to the Gitea registry
        env:
          NAME: ${{ steps.target.outputs.name }}
          VERSION: ${{ steps.target.outputs.version }}
          DIST_TAG: ${{ steps.target.outputs.dist_tag }}
          DIR: ${{ steps.target.outputs.dir }}
        run: |
          set -euo pipefail
          install -m 600 /dev/null "$NPMRC"
          {
            printf '@bitsquare:registry=%s\n' "$GITEA_REGISTRY"
            printf '//%s:_authToken=%s\n' "${GITEA_REGISTRY#*://}" "$GITEA_REGISTRY_TOKEN"
          } >> "$NPMRC"
          export npm_config_userconfig="$NPMRC"

          if npm view "${NAME}@${VERSION}" version --@bitsquare:registry="$GITEA_REGISTRY" >/dev/null 2>&1; then
            echo "${NAME}@${VERSION} is already on Gitea — skipping."
          else
            # pnpm, not npm: npm ships `workspace:*` verbatim and the install
            # then fails with EUNSUPPORTEDPROTOCOL. --no-git-checks because a
            # tag build is a detached HEAD.
            #
            # The registry is named as `--@bitsquare:registry`, not `--registry`.
            # Every package here is scoped, and for a scoped package npm resolves
            # `@scope:registry` ahead of `registry` — so a bare flag loses to any
            # project .npmrc that sets the scoped key.
            (cd "$DIR" && pnpm publish --ignore-scripts --no-git-checks --tag "$DIST_TAG" --@bitsquare:registry="$GITEA_REGISTRY")
          fi

      - name: Publish to npmjs
        env:
          NAME: ${{ steps.target.outputs.name }}
          VERSION: ${{ steps.target.outputs.version }}
          DIST_TAG: ${{ steps.target.outputs.dist_tag }}
          DIR: ${{ steps.target.outputs.dir }}
        run: |
          set -euo pipefail
          install -m 600 /dev/null "$NPMRC"
          {
            printf '@bitsquare:registry=%s\n' "$NPMJS_REGISTRY"
            printf '//%s:_authToken=%s\n' "${NPMJS_REGISTRY#*://}" "$NPMJS_TOKEN"
          } >> "$NPMRC"
          export npm_config_userconfig="$NPMRC"

          if npm view "${NAME}@${VERSION}" version --@bitsquare:registry="$NPMJS_REGISTRY" >/dev/null 2>&1; then
            echo "${NAME}@${VERSION} is already on npmjs — skipping."
          else
            # No --provenance: that needs GitHub Actions OIDC, which Gitea has no
            # equivalent for.
            #
            # Scoped flag, as above — and it matters most here. With a bare
            # `--registry` this line was measured uploading to Gitea whenever a
            # project .npmrc mapped the scope, which is the one mistake npmjs
            # will not let you take back.
            (cd "$DIR" && pnpm publish --ignore-scripts --no-git-checks --tag "$DIST_TAG" --access public --@bitsquare:registry="$NPMJS_REGISTRY")
          fi

      - name: Remove the registry credentials
        if: always()
        run: rm -f "$NPMRC"

      - name: Create the Gitea release
        env:
          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
          TAG: ${{ steps.target.outputs.tag }}
          NAME: ${{ steps.target.outputs.name }}
          VERSION: ${{ steps.target.outputs.version }}
          DIST_TAG: ${{ steps.target.outputs.dist_tag }}
          DIR: ${{ steps.target.outputs.dir }}
        run: |
          set -euo pipefail
          api="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/releases"

          status=$(curl -sS -o /dev/null -w '%{http_code}' \
            -H "Authorization: token ${GITEA_TOKEN}" "${api}/tags/${TAG}")
          if [ "$status" = "200" ]; then
            echo "A release for ${TAG} already exists — leaving it alone."
            exit 0
          fi

          # The section of the hand-written changelog that names this version.
          notes=""
          if [ -f "${DIR}/CHANGELOG.md" ]; then
            notes=$(awk -v v="$VERSION" '
              /^## / { if (found) exit; if (index($0, v)) { found = 1; next } }
              found  { print }
            ' "${DIR}/CHANGELOG.md")
          fi
          export NOTES="$notes"

          node -e '
            const { NAME, VERSION, TAG, DIST_TAG, NOTES } = process.env;
            const install =
              DIST_TAG === "latest"
                ? `npm install -g ${NAME}`
                : `npm install -g ${NAME}@${VERSION}`;
            const body = [
              NOTES.trim(),
              "",
              "```sh",
              install,
              "```",
            ].join("\n").trim();
            console.log(JSON.stringify({
              tag_name: TAG,
              name: `${NAME} v${VERSION}`,
              body,
              draft: false,
              prerelease: DIST_TAG !== "latest",
            }));
          ' > release.json

          curl -sS -f -X POST \
            -H "Authorization: token ${GITEA_TOKEN}" \
            -H "Content-Type: application/json" \
            --data-binary @release.json \
            "$api"
          rm -f release.json

      - name: Summarise
        # Reporting only; never the reason a green release goes red.
        continue-on-error: true
        env:
          NAME: ${{ steps.target.outputs.name }}
          VERSION: ${{ steps.target.outputs.version }}
          DIST_TAG: ${{ steps.target.outputs.dist_tag }}
        run: |
          set -euo pipefail
          : "${GITHUB_STEP_SUMMARY:=/dev/null}"
          {
            echo "### Released \`${NAME}@${VERSION}\` (\`${DIST_TAG}\`)"
            echo ""
            echo "- npmjs: \`npm install -g ${NAME}@${VERSION}\`"
            # Scoped, never a bare `--registry`: Gitea serves @bitsquare only and
            # does not proxy npmjs, so a bare flag sends every transitive
            # dependency to a registry that has never heard of them.
            echo "- Gitea: \`npm install -g ${NAME}@${VERSION} --@bitsquare:registry=${GITEA_REGISTRY}\`"
          } >> "$GITHUB_STEP_SUMMARY"