contentful__skills/.github/workflows/release.yml

name: Release

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  id-token: write

jobs:
  release:
    if: "!startsWith(github.event.head_commit.message, 'chore(release):')"
    runs-on: ubuntu-latest
    steps:
      - name: Retrieve Secrets from Vault
        id: vault
        uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3.4.0
        with:
          url: ${{ secrets.VAULT_URL }}
          role: ${{ github.event.repository.name }}-github-action
          method: jwt
          path: github-actions
          exportEnv: false
          secrets: |
            secret/data/github/github_packages_write GITHUB_PACKAGES_WRITE_TOKEN | GITHUB_PACKAGES_WRITE_TOKEN;
            github/token/${{ github.event.repository.name }}-semantic-release token | GITHUB_TOKEN ;
            secret/data/github/automation-app-user GH_USER_NAME | GIT_COMMITTER_NAME ;
            secret/data/github/automation-app-user GH_USER_EMAIL | GIT_COMMITTER_EMAIL ;

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          token: ${{ steps.vault.outputs.GITHUB_TOKEN }}

      - name: Get Automation Bot User ID
        id: get-user-id
        run: |
          USER_ID=$(gh api "/users/contentful-automation[bot]" --jq .id)
          if [ -z "$USER_ID" ] || [ "$USER_ID" = "null" ]; then
            echo "Error: Failed to retrieve bot user ID"
            exit 1
          fi
          echo "user-id=$USER_ID" >> "$GITHUB_OUTPUT"
        env:
          GITHUB_TOKEN: ${{ steps.vault.outputs.GITHUB_TOKEN }}

      - name: Configure git
        run: |
          git config --global user.name 'contentful-automation[bot]'
          git config --global user.email '${{ steps.get-user-id.outputs.user-id }}+contentful-automation[bot]@users.noreply.github.com'

      - name: Setup npmrc for publishing
        run: echo "//npm.pkg.github.com/:_authToken=${{ steps.vault.outputs.GITHUB_PACKAGES_WRITE_TOKEN }}" >> "$HOME/.npmrc"

      - uses: pnpm/action-setup@739bfe42ca9233c5e6aca07c1a25a9d34aca49b0 # v6

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: ".nvmrc"
          cache: pnpm
          registry-url: https://npm.pkg.github.com/

      - name: Install dependencies
        run: pnpm install --frozen-lockfile
        env:
          NODE_AUTH_TOKEN: ${{ steps.vault.outputs.GITHUB_PACKAGES_WRITE_TOKEN }}

      - name: Release
        run: pnpm exec release-it --ci
        env:
          GITHUB_TOKEN: ${{ steps.vault.outputs.GITHUB_TOKEN }}
          NODE_AUTH_TOKEN: ${{ steps.vault.outputs.GITHUB_PACKAGES_WRITE_TOKEN }}

      # Future: publish individual skills to GitHub Packages
      # - name: Publish skills to GitHub Packages
      #   run: |
      #     for dir in skills/*/; do
      #       if [ -f "$dir/package.json" ]; then
      #         echo "Publishing $(basename $dir)..."
      #         cd "$dir"
      #         npm publish --registry https://npm.pkg.github.com/ || true
      #         cd ../..
      #       fi
      #     done
      #   env:
      #     NODE_AUTH_TOKEN: ${{ steps.vault.outputs.GITHUB_PACKAGES_WRITE_TOKEN }}