stripe__link-cli/.github/workflows/release.yml

name: Release

on:
  push:
    branches: [main]

concurrency: ${{ github.workflow }}-${{ github.ref }}

permissions: {}

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      id-token: write
    outputs:
      published: ${{ steps.changesets.outputs.published }}
      publishedPackages: ${{ steps.changesets.outputs.publishedPackages }}
      cliPublished: ${{ steps.cli_published.outputs.value }}
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false

      - uses: pnpm/action-setup@f520eceda224fe1a4aed5a2a27a194379a409996 # v6

      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: 24
          cache: pnpm
          registry-url: https://registry.npmjs.org

      - run: pnpm install --frozen-lockfile

      - run: pnpm turbo run build

      - name: Create release PR or publish
        id: changesets
        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1
        with:
          publish: pnpm changeset publish
          title: 'Version Packages'
          commit: 'Version Packages'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Check whether the CLI was published
        id: cli_published
        if: steps.changesets.outputs.published == 'true'
        env:
          PUBLISHED_PACKAGES: ${{ steps.changesets.outputs.publishedPackages }}
        run: |
          cli_published="$(jq -r 'any(.[]; .name == "@stripe/link-cli")' <<<"$PUBLISHED_PACKAGES")"
          echo "value=$cli_published" >> "$GITHUB_OUTPUT"

      - name: Upload built CLI to GitHub Release
        if: steps.cli_published.outputs.value == 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          STEPS_CHANGESETS_OUTPUTS_PUBLISHEDPACKAGES: ${{ steps.changesets.outputs.publishedPackages }}
        run: |
          TAG=$(printf '%s' "$STEPS_CHANGESETS_OUTPUTS_PUBLISHEDPACKAGES" \
            | jq -r '.[] | select(.name == "@stripe/link-cli") | "@stripe/link-cli@" + .version')
          if [ -n "$TAG" ]; then
            sha256sum packages/cli/dist/cli.js > packages/cli/dist/cli.js.sha256
            gh release upload "$TAG" packages/cli/dist/cli.js packages/cli/dist/cli.js.sha256 --clobber
          fi

  build-sea:
    needs: release
    if: needs.release.outputs.cliPublished == 'true'
    permissions:
      contents: write
    strategy:
      matrix:
        include:
          - os: ubuntu-latest
            asset_name: link-cli-linux-x64
          - os: macos-latest
            asset_name: link-cli-macos-arm64
          - os: windows-latest
            asset_name: link-cli-win-x64.exe
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@f520eceda224fe1a4aed5a2a27a194379a409996 # v6
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: 26
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm turbo run build
      - run: pnpm --filter @stripe/link-cli run build:sea

      - name: Build SEA
        run: node --build-sea packages/cli/sea-config.json

      - name: Rename binary (Unix)
        if: runner.os != 'Windows'
        run: mv sea-output ${{ matrix.asset_name }} && chmod +x ${{ matrix.asset_name }}

      - name: Rename binary (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: Rename-Item sea-output ${{ matrix.asset_name }}

      - name: Sign binary (macOS only)
        if: runner.os == 'macOS'
        run: codesign --sign - ${{ matrix.asset_name }}

      - name: Generate checksum
        shell: bash
        run: sha256sum ${{ matrix.asset_name }} > ${{ matrix.asset_name }}.sha256

      - name: Upload to release
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NEEDS_RELEASE_OUTPUTS_PUBLISHEDPACKAGES: ${{ needs.release.outputs.publishedPackages }}
        run: |
          TAG=$(printf '%s' "$NEEDS_RELEASE_OUTPUTS_PUBLISHEDPACKAGES" \
            | jq -r '.[] | select(.name == "@stripe/link-cli") | "@stripe/link-cli@" + .version')
          gh release upload "$TAG" \
            ${{ matrix.asset_name }} \
            ${{ matrix.asset_name }}.sha256 \
            --clobber