publish-github-release.yml

name: PUBLISH — GitHub Release

on:
  workflow_call:
    inputs:
      tag:
        required: true
        type: string
      title:
        required: true
        type: string
      target_sha:
        required: true
        type: string
      prerelease:
        required: true
        type: boolean
      rolling_tag:
        required: true
        type: boolean
      generate_notes:
        required: true
        type: boolean
      notes:
        required: false
        default: ""
        type: string
      assets:
        required: false
        default: ""
        type: string
      assets_dir:
        required: false
        default: ""
        type: string
      assets_artifact:
        required: false
        default: ""
        type: string
      assets_artifact_path:
        required: false
        default: dist/release-assets
        type: string
      clobber:
        required: false
        default: true
        type: boolean
      prune_assets:
        required: false
        default: false
        type: boolean
      release_message:
        required: false
        default: ""
        type: string

permissions:
  contents: write

concurrency:
  group: publish-github-release-${{ inputs.tag }}
  cancel-in-progress: false

jobs:
  trusted_ref_guard:
    name: Trusted workflow ref guard
    permissions:
      contents: read
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Admit trusted workflow control ref
        env:
          CALLER_REPOSITORY: ${{ github.repository }}
          WORKFLOW_REPOSITORY: ${{ job.workflow_repository }}
          WORKFLOW_REF: ${{ job.workflow_ref }}
          WORKFLOW_FILE: publish-github-release.yml
        run: |
          set -euo pipefail
          test "$CALLER_REPOSITORY" = "$WORKFLOW_REPOSITORY"
          case "$WORKFLOW_REF" in
            "$WORKFLOW_REPOSITORY/.github/workflows/$WORKFLOW_FILE@refs/heads/dev"|\
            "$WORKFLOW_REPOSITORY/.github/workflows/$WORKFLOW_FILE@refs/heads/preview"|\
            "$WORKFLOW_REPOSITORY/.github/workflows/$WORKFLOW_FILE@refs/heads/main") ;;
            *) echo "Untrusted workflow control ref: $WORKFLOW_REF" >&2; exit 1 ;;
          esac

  release_actor_guard:
    needs: [trusted_ref_guard]
    name: Release actor guard
    permissions:
      contents: read
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout trusted workflow control bytes
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
        with:
          repository: ${{ job.workflow_repository }}
          ref: ${{ job.workflow_sha }}
          persist-credentials: false
      - name: Authorize release actor
        uses: ./.github/actions/release-actor-guard
        with:
          team_slug: release-admins
          app_id: ${{ secrets.RELEASE_BOT_APP_ID }}
          private_key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}

  publish:
    needs: [release_actor_guard]
    runs-on: ubuntu-latest
    timeout-minutes: 120
    environment: release-shared
    env:
      RELEASE_BOT_APP_ID: ${{ secrets.RELEASE_BOT_APP_ID }}
      RELEASE_BOT_PRIVATE_KEY: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
    steps:
      - name: Checkout trusted workflow control bytes
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
        with:
          repository: ${{ job.workflow_repository }}
          ref: ${{ job.workflow_sha }}
          fetch-depth: 0
          persist-credentials: false

      - name: Setup Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
        with:
          node-version: 22.x

      - name: Validate publish inputs
        env:
          INPUT_TAG: ${{ inputs.tag }}
          INPUT_TITLE: ${{ inputs.title }}
          INPUT_TARGET_SHA: ${{ inputs.target_sha }}
          INPUT_PRERELEASE: ${{ inputs.prerelease }}
          INPUT_ROLLING_TAG: ${{ inputs.rolling_tag }}
          INPUT_GENERATE_NOTES: ${{ inputs.generate_notes }}
          INPUT_CLOBBER: ${{ inputs.clobber }}
          INPUT_PRUNE_ASSETS: ${{ inputs.prune_assets }}
          INPUT_ASSETS_ARTIFACT: ${{ inputs.assets_artifact }}
          INPUT_ASSETS_ARTIFACT_PATH: ${{ inputs.assets_artifact_path }}
        run: |
          set -euo pipefail

          require_bool() {
            case "$2" in
              true|false) ;;
              *) echo "$1 must be true or false." >&2; exit 1 ;;
            esac
          }

          require_safe_dist_path() {
            label="$1"
            value="$2"
            case "$value" in
              dist/*) ;;
              *) echo "$label must be a relative path under dist/." >&2; exit 1 ;;
            esac
            case "/$value/" in
              */../*|*/./*) echo "$label must not contain traversal segments." >&2; exit 1 ;;
            esac
            case "$value" in
              *\\*) echo "$label must use forward slashes." >&2; exit 1 ;;
            esac
          }

          if [ -z "$INPUT_TAG" ] || ! git check-ref-format "refs/tags/$INPUT_TAG" >/dev/null; then
            echo "tag must be a valid Git tag name." >&2
            exit 1
          fi
          if [ -z "$INPUT_TITLE" ]; then
            echo "title is required." >&2
            exit 1
          fi
          case "$INPUT_TARGET_SHA" in
            ''|*[!0-9a-fA-F]*) echo "target_sha must be a hexadecimal commit SHA." >&2; exit 1 ;;
          esac
          case "${#INPUT_TARGET_SHA}" in
            40|64) ;;
            *) echo "target_sha must contain 40 or 64 hexadecimal characters." >&2; exit 1 ;;
          esac

          require_bool prerelease "$INPUT_PRERELEASE"
          require_bool rolling_tag "$INPUT_ROLLING_TAG"
          require_bool generate_notes "$INPUT_GENERATE_NOTES"
          require_bool clobber "$INPUT_CLOBBER"
          require_bool prune_assets "$INPUT_PRUNE_ASSETS"

          if [ -n "$INPUT_ASSETS_ARTIFACT" ]; then
            require_safe_dist_path assets_artifact_path "$INPUT_ASSETS_ARTIFACT_PATH"
          fi

      - name: Create GitHub App token (release bot)
        id: app_token
        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547
        if: ${{ env.RELEASE_BOT_APP_ID != '' && env.RELEASE_BOT_PRIVATE_KEY != '' }}
        with:
          app-id: ${{ env.RELEASE_BOT_APP_ID }}
          private-key: ${{ env.RELEASE_BOT_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: ${{ github.event.repository.name }}
          permission-contents: write

      - name: Configure git remote auth (release bot)
        if: ${{ steps.app_token.outcome == 'success' && steps.app_token.outputs.token != '' }}
        env:
          TOKEN: ${{ steps.app_token.outputs.token }}
        run: |
          set -euo pipefail
          git remote set-url origin "https://x-access-token:${TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
          # Ensure we aren't still using GITHUB_TOKEN credentials from checkout.
          git config --local --unset-all http.https://github.com/.extraheader 2>/dev/null || true

      - name: Download release assets artifact
        if: ${{ inputs.assets_artifact != '' }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
        with:
          name: ${{ inputs.assets_artifact }}
          path: ${{ inputs.assets_artifact_path }}

      - name: Publish GitHub release (pipeline)
        env:
          GH_TOKEN: ${{ (steps.app_token.outputs.token != '' && steps.app_token.outputs.token) || github.token }}
          GH_REPO: ${{ github.repository }}
          INPUT_TAG: ${{ inputs.tag }}
          INPUT_TITLE: ${{ inputs.title }}
          INPUT_TARGET_SHA: ${{ inputs.target_sha }}
          INPUT_PRERELEASE: ${{ inputs.prerelease }}
          INPUT_ROLLING_TAG: ${{ inputs.rolling_tag }}
          INPUT_GENERATE_NOTES: ${{ inputs.generate_notes }}
          INPUT_CLOBBER: ${{ inputs.clobber }}
          INPUT_PRUNE_ASSETS: ${{ inputs.prune_assets }}
          NOTES: ${{ inputs.notes }}
          ASSETS: ${{ inputs.assets }}
          assets_dir: ${{ inputs.assets_dir }}
          release_message: ${{ inputs.release_message }}
        run: |
          set -euo pipefail
          node scripts/pipeline/run.mjs github-publish-release \
            --tag "$INPUT_TAG" \
            --title "$INPUT_TITLE" \
            --target-sha "$INPUT_TARGET_SHA" \
            --prerelease "$INPUT_PRERELEASE" \
            --rolling-tag "$INPUT_ROLLING_TAG" \
            --generate-notes "$INPUT_GENERATE_NOTES" \
            --notes "${NOTES}" \
            --assets "${ASSETS}" \
            --assets-dir "${assets_dir}" \
            --clobber "$INPUT_CLOBBER" \
            --prune-assets "$INPUT_PRUNE_ASSETS" \
            --release-message "${release_message}"