release.yml

name: Release

on:
  push:
    branches:
      - main
  # Fallback only: a GITHUB_TOKEN merge of the version PR does not emit push.
  # PAT merges (the usual path) already fire the push event above — do not
  # also handle those here or two publishes race.
  pull_request:
    types: [closed]
    branches:
      - main

# One publish at a time. Do not cancel an in-flight npm publish.
concurrency:
  group: release-${{ github.repository }}
  cancel-in-progress: false

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    if: >
      github.repository_owner == 'wangyuling93' &&
      (github.event_name == 'push' ||
       (github.event_name == 'pull_request' &&
        github.event.pull_request.merged == true &&
        github.event.pull_request.head.ref == 'changeset-release/main' &&
        github.event.pull_request.merged_by.login == 'github-actions[bot]'))
    outputs:
      packages_published: ${{ steps.changesets.outputs.published }}
      kimi_native_release: ${{ steps.kimi-release.outputs.should_publish }}
      kimi_release_tag: ${{ steps.kimi-release.outputs.tag }}
    permissions:
      contents: write
      pull-requests: write
      id-token: write # Required for NPM Trusted Publishing (OIDC)
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          # On pull_request (closed) events the checkout defaults to the PR
          # merge ref; always base the release on main's post-merge state.
          ref: main
          # checkout's default extraheader uses the job GITHUB_TOKEN and beats
          # changesets/action's .netrc PAT, so version-PR updates are pushed
          # as github-actions[bot] and CI sits in action_required. Leave
          # credentials unset; the action writes .netrc from CHANGESETS_TOKEN.
          persist-credentials: false

      - name: Detect release mode
        id: mode
        env:
          EVENT_NAME: ${{ github.event_name }}
        run: |
          set -euo pipefail
          has_changesets=false
          if find .changeset -maxdepth 1 -name '*.md' ! -name 'README.md' | grep -q .; then
            has_changesets=true
          fi

          is_release_merge=false
          subject=$(git log -1 --format=%s)
          if [ "$EVENT_NAME" = "pull_request" ]; then
            is_release_merge=true
          elif [[ "$subject" == *"changeset-release/main"* ]]; then
            is_release_merge=true
          elif [ "$subject" = "ci: release packages" ]; then
            is_release_merge=true
          fi

          if [ "$has_changesets" = true ]; then
            echo "mode=version" >> "$GITHUB_OUTPUT"
          elif [ "$is_release_merge" = true ]; then
            echo "mode=publish" >> "$GITHUB_OUTPUT"
          else
            echo "mode=skip" >> "$GITHUB_OUTPUT"
          fi
          echo "mode has_changesets=$has_changesets is_release_merge=$is_release_merge subject=$subject"

      - name: Setup pnpm
        if: steps.mode.outputs.mode != 'skip'
        uses: pnpm/action-setup@v6

      - name: Setup Node.js
        if: steps.mode.outputs.mode != 'skip'
        uses: actions/setup-node@v6
        with:
          node-version-file: .nvmrc
          cache: "pnpm"
          registry-url: "https://registry.npmjs.org"

      - name: Upgrade npm for Trusted Publishing
        if: steps.mode.outputs.mode == 'publish'
        run: npm install -g npm@11

      - name: Install dependencies
        if: steps.mode.outputs.mode != 'skip'
        run: pnpm install --frozen-lockfile

      - name: Generate Kimi Code built-in catalog
        if: steps.mode.outputs.mode == 'publish'
        shell: bash
        run: |
          CATALOG_FILE="$RUNNER_TEMP/kimi-code-built-in-catalog.json"
          node apps/kimi-code/scripts/update-catalog.mjs --out "$CATALOG_FILE"
          echo "KIMI_CODE_BUILT_IN_CATALOG_FILE=$CATALOG_FILE" >> "$GITHUB_ENV"

      - name: Build packages
        if: steps.mode.outputs.mode == 'publish'
        run: pnpm build

      - name: Create Release Pull Request or Publish to npm
        id: changesets
        if: steps.mode.outputs.mode != 'skip'
        uses: changesets/action@v1
        with:
          publish: pnpm changeset publish
          version: pnpm run version:release
          commit: "ci: release packages"
          title: "ci: release packages"
          commitMode: git-cli
          # Use the maintainer's PAT so the version PR is authored by a real
          # account: PRs created by github-actions[bot] always require manual
          # workflow approval (the bot has no contribution history), which
          # stalls the auto-merge loop.
          github-token: ${{ secrets.CHANGESETS_TOKEN }}
        env:
          # Same token as the github-token input: changesets/action refuses a
          # mismatch between the two.
          GITHUB_TOKEN: ${{ secrets.CHANGESETS_TOKEN }}
          # Publishing uses npm OIDC trusted publishing (configured on the
          # package page); provenance is generated automatically. No token is
          # needed — NPM_TOKEN was only used to bootstrap the first publish.
          # id-token: write is granted above.

      # Auto-merge the version PR once the required CI checks pass. Uses
      # GitHub's native auto-merge (repo setting "Allow auto-merge" +
      # branch protection requiring status checks); changesets/action has no
      # such input of its own.
      - name: Enable auto-merge on the version PR
        if: steps.mode.outputs.mode != 'skip' && steps.changesets.outputs.pullRequestNumber != ''
        run: gh pr merge --repo "$GITHUB_REPOSITORY" --merge --auto "${{ steps.changesets.outputs.pullRequestNumber }}"
        env:
          # Auto-merge with the maintainer's PAT: merges performed with the
          # GITHUB_TOKEN are attributed to github-actions[bot], whose push /
          # closed events do not trigger workflows.
          GH_TOKEN: ${{ secrets.CHANGESETS_TOKEN }}

      - name: Resolve Kimi Code native release
        if: steps.changesets.outputs.published == 'true'
        id: kimi-release
        run: node apps/kimi-code/scripts/native/resolve-release.mjs
        env:
          CHANGESETS_PUBLISHED_PACKAGES: ${{ steps.changesets.outputs.publishedPackages }}

  deploy-docs:
    name: Deploy docs
    needs: release
    if: needs.release.outputs.packages_published == 'true' && github.repository_owner == 'MoonshotAI'
    uses: ./.github/workflows/docs-deploy.yml
    permissions:
      contents: read
      pages: write
      id-token: write

  native-artifacts:
    name: Native release artifact
    needs: release
    if: needs.release.outputs.kimi_native_release == 'true'
    uses: ./.github/workflows/_native-build.yml
    with:
      upload-artifact-prefix: kimi-code-native
      retention-days: 7
      sign-macos: true
    secrets:
      APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
      APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
      APPLE_NOTARIZATION_KEY_P8: ${{ secrets.APPLE_NOTARIZATION_KEY_P8 }}
      APPLE_NOTARIZATION_KEY_ID: ${{ secrets.APPLE_NOTARIZATION_KEY_ID }}
      APPLE_NOTARIZATION_ISSUER_ID: ${{ secrets.APPLE_NOTARIZATION_ISSUER_ID }}

  publish-native-assets:
    name: Publish native release assets
    needs:
      - release
      - native-artifacts
    if: needs.release.outputs.kimi_native_release == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Download native artifacts
        uses: actions/download-artifact@v8
        with:
          pattern: kimi-code-native-*
          path: dist-native-release
          merge-multiple: true

      - name: Produce manifest.json
        env:
          RELEASE_TAG: ${{ needs.release.outputs.kimi_release_tag }}
        run: node apps/kimi-code/scripts/native/produce-manifest.mjs dist-native-release "$RELEASE_TAG"

      - name: Upload assets to GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ needs.release.outputs.kimi_release_tag }}
        run: gh release upload "$RELEASE_TAG" dist-native-release/* --clobber