release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  ci:
    uses: ./.github/workflows/ci.yml

  release:
    needs: ci
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: "22"

      - name: Check that the tag matches package.json
        if: github.ref_type == 'tag'
        run: |
          version="$(node -p "require('./package.json').version")"
          [ "v$version" = "$GITHUB_REF_NAME" ] || { echo "tag $GITHUB_REF_NAME does not match package.json version $version"; exit 1; }

      - name: Build release archive
        run: |
          node scripts/build-release-archive.mjs open-ultracode-release.tar.gz
          sha256sum open-ultracode-release.tar.gz > open-ultracode-release.tar.gz.sha256

      - name: Publish GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          release_flags=()
          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
            tag="${GITHUB_REF_NAME}"
            case "$tag" in
              *-*) release_flags+=(--prerelease) ;;
            esac
          else
            # Manual runs must never become "latest", which install.sh and install.ps1 download.
            tag="manual-${GITHUB_RUN_NUMBER}"
            release_flags+=(--prerelease)
          fi
          gh release create "$tag" open-ultracode-release.tar.gz open-ultracode-release.tar.gz.sha256 \
            --title "$tag" \
            --notes "OpenUltraCode release archive for install.sh and install.ps1." \
            "${release_flags[@]}" \
            --target "$GITHUB_SHA"