release.yml

# Unified release workflow for Waza CLI + azd extension
#
# Two independent flows:
#   Flow 1: Standalone CLI — parallel matrix build → GitHub Release
#   Flow 2: azd Extension — sync versions → build → pack → release → publish → PR back
#
# Triggers:
#   - Tag push matching v*.*.*
#
# See docs/RELEASE.md for usage details.

name: Release

on:
  push:
    tags:
      - 'v*.*.*'

permissions:
  contents: write
  pull-requests: write
  statuses: write

jobs:
  # ──────────────────────────────────────────────
  # Shared: Extract and validate the release version
  # ──────────────────────────────────────────────
  setup-version:
    name: Setup Version
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
      tag: ${{ steps.version.outputs.tag }}
    steps:
      - name: Determine Version
        id: version
        run: |
          VERSION="${GITHUB_REF_NAME#v}"

          # Validate semver format (major.minor.patch with optional pre-release)
          if ! echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?(\+[a-zA-Z0-9.]+)?$'; then
            echo "::error::Invalid semver: $VERSION"
            exit 1
          fi

          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "tag=$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"
          echo "Releasing version: $VERSION (tag: $GITHUB_REF_NAME)"

  # ════════════════════════════════════════════════
  # FLOW 1: Standalone CLI Release
  # Parallel matrix build, then collect and create GitHub Release
  # ════════════════════════════════════════════════

  build-cli:
    name: CLI ${{ matrix.os }}/${{ matrix.arch }}
    needs: setup-version
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - os: linux
            arch: amd64
          - os: linux
            arch: arm64
          - os: darwin
            arch: amd64
          - os: darwin
            arch: arm64
          - os: windows
            arch: amd64
          - os: windows
            arch: arm64
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4
        with:
          lfs: true

      - name: Setup Go Environment
        uses: actions/setup-go@v5
        with:
          go-version: '1.26'
          cache-dependency-path: go.sum

      - name: Setup Node.js (for web UI build)
        if: hashFiles('web/package.json') != ''
        uses: actions/setup-node@v4
        with:
          node-version: '22'

      - name: Build Web UI
        if: hashFiles('web/package.json') != ''
        working-directory: web
        run: npm ci && npm run build

      - name: Build Binary
        env:
          GOOS: ${{ matrix.os }}
          GOARCH: ${{ matrix.arch }}
          CGO_ENABLED: '0'
        run: |
          VERSION="${{ needs.setup-version.outputs.version }}"
          BINARY_NAME="waza-${{ matrix.os }}-${{ matrix.arch }}"
          if [ "${{ matrix.os }}" = "windows" ]; then
            BINARY_NAME="${BINARY_NAME}.exe"
          fi

          go build \
            -ldflags "-X main.version=${VERSION}" \
            -o "${BINARY_NAME}" \
            ./cmd/waza

          echo "Built ${BINARY_NAME}"

      - name: Upload Binary Artifact
        uses: actions/upload-artifact@v4
        with:
          name: cli-waza-${{ matrix.os }}-${{ matrix.arch }}
          path: waza-${{ matrix.os }}-${{ matrix.arch }}*
          if-no-files-found: error

  release-cli:
    name: Release CLI
    needs: [setup-version, build-cli]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Download CLI Artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: cli-*
          path: artifacts
          merge-multiple: true

      - name: Generate SHA256 Checksums
        working-directory: artifacts
        run: |
          sha256sum * > checksums.txt
          echo "Generated checksums:"
          cat checksums.txt

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="${{ needs.setup-version.outputs.tag }}"
          gh release create "$TAG" \
            --repo "${{ github.repository }}" \
            --title "Waza $TAG" \
            --generate-notes \
            artifacts/*

  # ════════════════════════════════════════════════
  # FLOW 2: azd Extension Release
  # Single job: sync versions → build → pack → release → publish → PR back
  # ════════════════════════════════════════════════

  release-extension:
    name: Release Extension
    needs: setup-version
    runs-on: ubuntu-latest
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      VERSION: ${{ needs.setup-version.outputs.version }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          lfs: true

      - name: Setup Go Environment
        uses: actions/setup-go@v5
        with:
          go-version: '1.26'
          cache-dependency-path: go.sum

      - name: Setup Node.js (for web UI build)
        if: hashFiles('web/package.json') != ''
        uses: actions/setup-node@v4
        with:
          node-version: '22'

      - name: Build Web UI
        if: hashFiles('web/package.json') != ''
        working-directory: web
        run: npm ci && npm run build

      - name: Install Azure Developer CLI
        uses: Azure/setup-azd@v2

      - name: Enable azd Extensions
        run: azd config set alpha.extensions on

      - name: Install azd Extensions Developer Kit
        run: azd extension install microsoft.azd.extensions --source azd

      # ── Sync version files FIRST so all azd commands see the correct version ──
      - name: Sync Version Files
        run: |
          echo "$VERSION" > version.txt
          sed -i "s/^version: .*/version: $VERSION/" extension.yaml
          echo "Synced version.txt and extension.yaml to $VERSION"

      # ── Build & pack ──
      - name: Build Extension
        run: azd x build --all --skip-install

      - name: Pack Extension
        run: azd x pack -o ./artifacts

      # ── Release & publish ──
      - name: Release Extension
        run: |
          azd x release \
            --repo ${{ github.repository }} \
            --version "$VERSION" \
            --title "Waza azd Extension v${VERSION}" \
            --notes-file "./CHANGELOG.md" \
            --artifacts "./artifacts/*.zip,./artifacts/*.tar.gz" \
            --confirm

      - name: Publish Extension
        run: |
          azd x publish \
            --repo ${{ github.repository }} \
            --version "$VERSION" \
            --artifacts "./artifacts/*.zip,./artifacts/*.tar.gz" \
            --registry ./registry.json

      # ── Commit version + registry changes back via PR ──
      # Enterprise policy blocks GITHUB_TOKEN from creating PRs.
      # Push the branch and create the PR. Auto-merge if permitted,
      # otherwise leave the PR open for a maintainer to merge.
      - name: Create Release PR
        run: |
          BRANCH="release/v${VERSION}"

          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          # Delete existing remote branch if it exists (handle retries)
          git push origin --delete "$BRANCH" 2>/dev/null || true

          git checkout -b "$BRANCH"
          git add registry.json version.txt extension.yaml
          git commit -m "chore: Update registry and sync versions for v${VERSION}"
          git push origin "$BRANCH"

          # Try to create PR — if enterprise blocks GITHUB_TOKEN PR creation,
          # log the branch URL and succeed so the release doesn't fail.
          PR_URL=$(gh pr create \
            --title "chore: Release v${VERSION} — registry and version sync" \
            --body "## Release v${VERSION}

          Automated update from the [Release](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) workflow.

          ### Changes
          - Updated \`registry.json\` with artifacts for extension version **${VERSION}**
          - Synced \`version.txt\` and \`extension.yaml\` to **${VERSION}**

          > **Note:** Merge this PR to complete the release." \
            --base main \
            --head "$BRANCH" 2>&1) || true

          if echo "$PR_URL" | grep -q "github.com"; then
            echo "✅ Created PR: $PR_URL"

            # Try to report statuses and auto-merge (best-effort)
            PR_SHA=$(git rev-parse HEAD)
            for CONTEXT in "ubuntu-latest" "Lint"; do
              gh api "repos/${{ github.repository }}/statuses/${PR_SHA}" \
                -f state=success \
                -f context="$CONTEXT" \
                -f description="Skipped — automated release PR (run ${{ github.run_id }})" 2>/dev/null || true
            done

            gh pr merge "$PR_URL" --squash --delete-branch 2>/dev/null && echo "✅ Auto-merged" || \
              echo "⚠️ Auto-merge not available — PR is open for manual merge"
          else
            echo "⚠️ Could not create PR (enterprise restriction). Branch pushed: release/v${VERSION}"
            echo "   Create PR manually: https://github.com/${{ github.repository }}/compare/main...release/v${VERSION}"
          fi