release-commit.yml

name: Publish commit preview

on:
  push:
    branches:
      - main
  workflow_run:
    workflows: [CI]
    types: [completed]
  issue_comment:
    types: [created]
  workflow_dispatch:
    inputs:
      pull_request:
        description: Open PR number (empty publishes the default branch)
        required: false
        type: string

permissions:
  contents: read

jobs:
  resolve:
    if: >-
      github.repository == 'kingsword09/zcode-cli' &&
      github.ref_name == github.event.repository.default_branch &&
      (github.event_name == 'push' ||
        (github.event_name == 'workflow_run' && github.event.workflow_run.event == 'pull_request' &&
          github.event.workflow_run.conclusion == 'success') ||
        (github.actor_id == '19650362' && github.triggering_actor == 'kingsword09' &&
          (github.event_name == 'workflow_dispatch' ||
            (github.event_name == 'issue_comment' && github.event.issue.pull_request &&
              github.event.comment.user.id == 19650362 && github.event.comment.body == '/pkg-pr-new'))))
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
      pull-requests: read
    outputs:
      sha: ${{ steps.target.outputs.sha }}
      pr_number: ${{ steps.target.outputs.pr_number }}
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          ref: ${{ github.workflow_sha }}
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: 24
          package-manager-cache: false
      - name: Authorize and resolve preview commit
        id: target
        env:
          GH_TOKEN: ${{ github.token }}
        run: node scripts/preview-comment.ts resolve

  preview:
    needs: resolve
    outputs:
      url: ${{ steps.published.outputs.url }}
    if: >-
      needs.resolve.outputs.sha != '' &&
      (github.event_name == 'push' || github.event_name == 'workflow_run' ||
        (github.actor_id == '19650362' && github.triggering_actor == 'kingsword09'))
    runs-on: ubuntu-latest
    timeout-minutes: 45
    permissions:
      contents: read
    # Job-level concurrency means an unauthorized comment cannot cancel a build.
    concurrency:
      group: zcode-cli-preview-${{ needs.resolve.outputs.pr_number || github.ref }}
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          ref: ${{ needs.resolve.outputs.sha }}
          persist-credentials: false

      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: 24
          package-manager-cache: false

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.4.1

      - name: Install extraction tools
        run: sudo apt-get update && sudo apt-get install -y p7zip-full

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build and test the locked runtime
        run: bun run release:build

      - name: Pack and install-test
        id: pack
        run: bun run release:pack

      - name: Verify release metadata is unchanged
        env:
          PREVIEW_SHA: ${{ needs.resolve.outputs.sha }}
        run: |
          test "$(git rev-parse HEAD)" = "$PREVIEW_SHA"
          git diff --exit-code -- package.json zcode-runtime.lock.json

      - name: Upload tested package
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: commit-preview-${{ needs.resolve.outputs.sha }}
          path: |
            .release/*.tgz
            .release/release.json
          include-hidden-files: true
          if-no-files-found: error
          retention-days: 14

      # The app must be installed on this repository. PR code receives no write
      # token; the separate trusted job below posts the result to the right PR.
      - name: Publish commit package
        env:
          PREVIEW_TARBALL: ${{ steps.pack.outputs.tarball }}
        run: bun run pkg-pr-new publish "$PREVIEW_TARBALL" --bin --comment=off --commentWithSha --no-template --json .release/preview.json

      - name: Verify published URL and show preview command
        id: published
        env:
          PREVIEW_SHA: ${{ needs.resolve.outputs.sha }}
        run: |
          node --input-type=module <<'NODE'
          import { readFileSync, appendFileSync } from 'node:fs';
          const { packages } = JSON.parse(readFileSync('.release/preview.json', 'utf8'));
          const sha = process.env.PREVIEW_SHA;
          const url = packages?.[0]?.url;
          const match = typeof url === 'string' && /^https:\/\/pkg\.pr\.new\/(?:kingsword09\/zcode-cli\/)?zcode-app-cli@([0-9a-f]{7,40})$/.exec(url);
          if (!/^[0-9a-f]{40}$/.test(sha) || packages.length !== 1 || packages[0].name !== 'zcode-app-cli' || !match || !sha.startsWith(match[1])) {
            throw new Error('Published package does not match the selected preview commit.');
          }
          const fullUrl = `https://pkg.pr.new/kingsword09/zcode-cli/zcode-app-cli@${sha}`;
          appendFileSync(process.env.GITHUB_OUTPUT, `url=${url}\n`);
          appendFileSync(process.env.GITHUB_STEP_SUMMARY, `Preview package: ${url}\n\n\`\`\`sh\nnpx --yes ${url}\n\`\`\`\n${url !== fullUrl ? `\nFull repository URL: ${fullUrl}\n` : ''}`);
          NODE

  report:
    needs: [resolve, preview]
    if: >-
      always() && needs.resolve.result == 'success' && needs.resolve.outputs.pr_number != '' &&
      (needs.preview.result == 'success' || needs.preview.result == 'failure') &&
      (github.event_name == 'workflow_run' ||
        (github.actor_id == '19650362' && github.triggering_actor == 'kingsword09'))
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          ref: ${{ github.workflow_sha }}
          persist-credentials: false
      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: 24
          package-manager-cache: false
      - name: Post preview result
        env:
          GH_TOKEN: ${{ github.token }}
          PREVIEW_PR_NUMBER: ${{ needs.resolve.outputs.pr_number }}
          PREVIEW_SHA: ${{ needs.resolve.outputs.sha }}
          PREVIEW_RESULT: ${{ needs.preview.result }}
          PREVIEW_URL: ${{ needs.preview.outputs.url }}
        run: node scripts/preview-comment.ts report