changesets-action/.github/workflows/release-pr.yml

name: Release PR

on:
  issue_comment:
    types: [created]

concurrency:
  group: ${{ github.workflow }}-${{ github.run_id }}
  cancel-in-progress: true

permissions: {}

jobs:
  release_check:
    name: Validate release request
    if: github.repository == 'changesets/action' && github.event.issue.pull_request && startsWith(github.event.comment.body, '/release-pr')
    timeout-minutes: 5
    runs-on: ubuntu-latest

    permissions:
      contents: read # to inspect the pull request commit state (changesets/action)
      issues: write # to add and remove reactions on the triggering comment (changesets/action)
      pull-requests: read # to inspect the pull request head state (changesets/action)

    steps:
      - id: report_in_progress
        run: |
          in_progress_reaction_id=$(gh api "/repos/$GH_REPO/issues/comments/$COMMENT_ID/reactions" -f content='eyes' --jq '.id')
          echo "in_progress_reaction_id=$in_progress_reaction_id" >> "$GITHUB_OUTPUT"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          COMMENT_ID: ${{ github.event.comment.id }}

      - id: parse_command
        run: |
          if [[ "$COMMENT_BODY" =~ ^/release-pr[[:space:]]+([0-9a-fA-F]{7,40})[[:space:]]*$ ]]
          then
            echo "requested_sha=${BASH_REMATCH[1]}" >> "$GITHUB_OUTPUT"
          else
            echo "Expected '/release-pr <sha>' where <sha> is a 7-40 character commit SHA."
            exit 1
          fi
        env:
          COMMENT_BODY: ${{ github.event.comment.body }}

      - id: check_authorization
        run: |
          if [[ "$AUTHOR_ASSOCIATION" == 'MEMBER' || "$AUTHOR_ASSOCIATION" == 'OWNER' || "$AUTHOR_ASSOCIATION" == 'COLLABORATOR' ]]
          then
            echo "User is authorized to release"
          else
            echo "User is not authorized to release"
            exit 1
          fi
        env:
          AUTHOR_ASSOCIATION: ${{ github.event.comment.author_association }}

      - id: resolve_requested_sha
        run: |
          requested_sha=$(echo "$REQUESTED_SHA" | tr '[:upper:]' '[:lower:]')

          mapfile -t matches < <(
            gh api "/repos/$GH_REPO/pulls/$ISSUE_NUMBER/commits" --paginate --jq '.[].sha' |
              awk -v sha="$requested_sha" 'index(tolower($0), sha) == 1 { print $0 }'
          )

          if [[ ${#matches[@]} -eq 0 ]]
          then
            echo "Requested SHA $REQUESTED_SHA is not part of this pull request."
            exit 1
          fi

          if [[ ${#matches[@]} -gt 1 ]]
          then
            echo "Requested SHA $REQUESTED_SHA is ambiguous for this pull request."
            exit 1
          fi

          resolved_sha="${matches[0]}"
          pr_head_sha=$(gh pr view "$ISSUE_NUMBER" --json headRefOid --jq '.headRefOid')

          if [[ "$resolved_sha" != "$pr_head_sha" ]]
          then
            echo "Requested SHA $resolved_sha is not the current PR head $pr_head_sha."
            exit 1
          fi

          echo "resolved_sha=$resolved_sha" >> "$GITHUB_OUTPUT"
          echo "pr_head_sha=$pr_head_sha" >> "$GITHUB_OUTPUT"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          ISSUE_NUMBER: ${{ github.event.issue.number }}
          REQUESTED_SHA: ${{ steps.parse_command.outputs.requested_sha }}

      - id: get_pr_head_repository
        run: |
          head_repository=$(gh pr view "$ISSUE_NUMBER" --json headRepositoryOwner,headRepository --jq '.headRepositoryOwner.login + "/" + .headRepository.name')
          echo "head_repository=$head_repository" >> "$GITHUB_OUTPUT"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ISSUE_NUMBER: ${{ github.event.issue.number }}

    outputs:
      in_progress_reaction_id: ${{ steps.report_in_progress.outputs.in_progress_reaction_id }}
      requested_sha: ${{ steps.parse_command.outputs.requested_sha }}
      resolved_sha: ${{ steps.resolve_requested_sha.outputs.resolved_sha }}
      pr_head_sha: ${{ steps.resolve_requested_sha.outputs.pr_head_sha }}
      head_repository: ${{ steps.get_pr_head_repository.outputs.head_repository }}

  release:
    name: Release snapshot
    if: github.repository == 'changesets/action'
    timeout-minutes: 20
    runs-on: ubuntu-latest
    needs: release_check

    permissions:
      contents: write # to create the release commit and publish snapshot artifacts (changesets/action)
      issues: write # to add and remove reactions on the triggering comment (changesets/action)
      pull-requests: write # to comment on the pull request with the release result (changesets/action)

    steps:
      - name: Check out repo
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - uses: ./.github/actions/ci-setup
        with:
          skip-cache: true # avoid cache poisoning attacks

      - name: Fetch validated commit from pull request head repository
        run: |
          git remote add pr-head "https://github.com/$HEAD_REPOSITORY.git"
          git fetch --no-tags pr-head "$RESOLVED_SHA"
        env:
          HEAD_REPOSITORY: ${{ needs.release_check.outputs.head_repository }}
          RESOLVED_SHA: ${{ needs.release_check.outputs.resolved_sha }}

      - name: Checkout validated commit
        run: git checkout --detach "$RESOLVED_SHA"
        env:
          RESOLVED_SHA: ${{ needs.release_check.outputs.resolved_sha }}

      - name: Check if Version Packages PR
        id: check_version_packages
        run: |
          version_packages=$(gh pr view "$ISSUE_NUMBER" --json headRefName --jq '.headRefName|startswith("changeset-release/")')
          echo "version_packages=$version_packages" >> "$GITHUB_OUTPUT"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ISSUE_NUMBER: ${{ github.event.issue.number }}

      - name: Reset Version Packages PR
        if: steps.check_version_packages.outputs.version_packages == 'true'
        run: git reset --hard HEAD~1

      - name: Create snapshot version
        run: pnpm changeset version --snapshot "pr$ISSUE_NUMBER"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ISSUE_NUMBER: ${{ github.event.issue.number }}

      - name: Build
        run: pnpm build

      - uses: ./.github/actions/setup-bot-auth
        id: bot-auth
        with:
          client-id: ${{ vars.APP_CLIENT_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          permission-contents: write # to push the release snapshot branch (release-pr.ts)

      - name: Release snapshot version
        run: pnpm release:pr
        env:
          GITHUB_TOKEN: ${{ steps.bot-auth.outputs.token }}

      - name: Add success reaction
        run: gh api "/repos/$GH_REPO/issues/comments/$COMMENT_ID/reactions" -f content='rocket'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          COMMENT_ID: ${{ github.event.comment.id }}

      - name: Remove in-progress reaction
        run: gh api -X DELETE "/repos/$GH_REPO/issues/comments/$COMMENT_ID/reactions/$IN_PROGRESS_REACTION_ID"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          COMMENT_ID: ${{ github.event.comment.id }}
          IN_PROGRESS_REACTION_ID: ${{ needs.release_check.outputs.in_progress_reaction_id }}

      - name: Comment success
        run: |
          published_commit="$(git rev-parse HEAD)"
          body="The release for \`$RESOLVED_SHA\` triggered by [this comment]($COMMENT_URL) has [succeeded]($RUN_URL). Published commit: [$GH_REPO@$published_commit](https://github.com/$GH_REPO/commit/$published_commit)."
          gh pr comment "$ISSUE_NUMBER" --body "$body"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          ISSUE_NUMBER: ${{ github.event.issue.number }}
          COMMENT_URL: ${{ github.event.comment.url }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          RESOLVED_SHA: ${{ needs.release_check.outputs.resolved_sha }}

  report-failure-if-needed:
    name: Report failure
    needs: [release_check, release]
    timeout-minutes: 2
    runs-on: ubuntu-latest
    if: failure() && github.repository == 'changesets/action' && (needs.release_check.result == 'failure' || needs.release.result == 'failure')

    permissions:
      issues: write # to add and remove reactions on the triggering comment (changesets/action)
      pull-requests: write # to comment on the pull request with the failure result (changesets/action)

    steps:
      - name: Add failure reaction
        run: gh api "/repos/$GH_REPO/issues/comments/$COMMENT_ID/reactions" -f content='-1'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          COMMENT_ID: ${{ github.event.comment.id }}

      - name: Remove in-progress reaction
        run: gh api -X DELETE "/repos/$GH_REPO/issues/comments/$COMMENT_ID/reactions/$IN_PROGRESS_REACTION_ID"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          COMMENT_ID: ${{ github.event.comment.id }}
          IN_PROGRESS_REACTION_ID: ${{ needs.release_check.outputs.in_progress_reaction_id }}

      - name: Comment failure
        run: |
          body="The release for \`$REQUESTED_SHA\` triggered by [this comment]($COMMENT_URL) has [failed]($RUN_URL)."
          gh pr comment "$ISSUE_NUMBER" --body "$body"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          ISSUE_NUMBER: ${{ github.event.issue.number }}
          COMMENT_URL: ${{ github.event.comment.url }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          REQUESTED_SHA: ${{ needs.release_check.outputs.requested_sha }}