post-release.yml

name: Post release after develop synced

on:
  repository_dispatch:
    types: [develop-synced]

jobs:
  post_release:
    runs-on: ubuntu-latest

    permissions:
      contents: write

    steps:
      - name: Read version from repository_dispatch payload
        id: meta
        env:
          PAYLOAD_VERSION: ${{ github.event.client_payload.version }}
        run: |
          set -euo pipefail
          if [ -z "${PAYLOAD_VERSION}" ]; then
            echo "No version in client_payload, skip post-release."
            echo "skip=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          echo "Using version from payload: ${PAYLOAD_VERSION}"
          echo "version=${PAYLOAD_VERSION}" >> "$GITHUB_OUTPUT"
          echo "skip=false" >> "$GITHUB_OUTPUT"

      - name: Checkout main
        if: steps.meta.outputs.skip != 'true'
        uses: actions/checkout@v4
        with:
          ref: main
          fetch-depth: 0
          persist-credentials: false

      - name: Configure git remote to use PAT
        if: steps.meta.outputs.skip != 'true'
        env:
          GH_PAT: ${{ secrets.CREATE_TAG_RELEASE_TOKEN }}
        run: |
          set -euo pipefail
          git remote set-url origin "https://x-access-token:${GH_PAT}@github.com/${GITHUB_REPOSITORY}.git"
          git remote -v

      - name: Fetch tags
        if: steps.meta.outputs.skip != 'true'
        run: |
          set -euo pipefail
          git fetch --tags --force

      - name: Check existing tag and release
        id: exist
        if: steps.meta.outputs.skip != 'true'
        env:
          VERSION: ${{ steps.meta.outputs.version }}
          GH_TOKEN: ${{ secrets.CREATE_TAG_RELEASE_TOKEN }}
        run: |
          set -euo pipefail
          TAG="v${VERSION}"

          if git rev-parse "refs/tags/${TAG}" >/dev/null 2>&1; then
            echo "Tag ${TAG} already exists, skip post-release."
            echo "skip=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          if gh release view "${TAG}" >/dev/null 2>&1; then
            echo "Release ${TAG} already exists, skip post-release."
            echo "skip=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          echo "skip=false" >> "$GITHUB_OUTPUT"

      - name: Ensure main changelog exists
        if: steps.meta.outputs.skip != 'true' && steps.exist.outputs.skip != 'true'
        run: |
          set -euo pipefail
          if [ ! -f "docs/assets/changelog/en/release.md" ]; then
            echo "Error: docs/assets/changelog/en/release.md not found in main."
            exit 1
          fi

      - name: Extract release body from main changelog
        id: body
        if: steps.meta.outputs.skip != 'true' && steps.exist.outputs.skip != 'true'
        env:
          VERSION: ${{ steps.meta.outputs.version }}
        run: |
          set -euo pipefail
          node <<'NODE'
          const fs = require('fs');

          const version = process.env.VERSION;
          const changelogPath = 'docs/assets/changelog/en/release.md';
          const content = fs.readFileSync(changelogPath, 'utf8');

          function escapeRegExp(str) {
            return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
          }

          const headerPattern = new RegExp('^#\\s*v?' + escapeRegExp(version) + '\\b', 'm');
          const match = headerPattern.exec(content);

          if (!match) {
            console.error('No changelog block for version', version, 'found in main changelog.');
            process.exit(1);
          }

          const startIndex = match.index;
          const rest = content.slice(startIndex);

          // Find the next release header after the current one.
          const nextHeaderPattern = /^#\s*v?\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?[^\n]*$/gm;
          let nextIndex = rest.length;
          let m;
          while ((m = nextHeaderPattern.exec(rest)) !== null) {
            if (m.index > 0) {
              nextIndex = m.index;
              break;
            }
          }

          const block = rest.slice(0, nextIndex).trimEnd() + '\n';
          if (!block.trim()) {
            console.error('Extracted changelog block is empty for version', version);
            process.exit(1);
          }
          fs.writeFileSync('release-body.md', block, 'utf8');
          NODE
          echo "has_body=true" >> "$GITHUB_OUTPUT"

      - name: Validate extracted release body
        if: steps.meta.outputs.skip != 'true' && steps.exist.outputs.skip != 'true' && steps.body.outputs.has_body == 'true'
        env:
          VERSION: ${{ steps.meta.outputs.version }}
        run: |
          set -euo pipefail
          if [ ! -s "release-body.md" ]; then
            echo "Error: release-body.md is missing or empty."
            exit 1
          fi

          if ! grep -Eq "^#\\s*v?${VERSION}\\b" release-body.md; then
            echo "Error: release-body.md does not start with expected version header v${VERSION}."
            exit 1
          fi

          HEADER_COUNT="$(grep -Ec '^#\s*v?[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.]+)?\b' release-body.md || true)"
          if [ "${HEADER_COUNT}" -ne 1 ]; then
            echo "Error: extracted release body contains ${HEADER_COUNT} release headers, expected exactly 1."
            exit 1
          fi

      - name: Verify gh identity
        if: steps.meta.outputs.skip != 'true' && steps.exist.outputs.skip != 'true' && steps.body.outputs.has_body == 'true'
        env:
          GH_TOKEN: ${{ secrets.CREATE_TAG_RELEASE_TOKEN }}
        run: |
          set -euo pipefail
          gh api user -q '.login'

      - name: Diagnose PAT repository permission
        if: steps.meta.outputs.skip != 'true' && steps.exist.outputs.skip != 'true' && steps.body.outputs.has_body == 'true'
        env:
          GH_TOKEN: ${{ secrets.CREATE_TAG_RELEASE_TOKEN }}
        run: |
          set -euo pipefail
          LOGIN=$(gh api user -q '.login')
          echo "PAT user: $LOGIN"
          OWNER=${GITHUB_REPOSITORY%%/*}
          REPO=${GITHUB_REPOSITORY#*/}
          RESP=$(gh api "/repos/$OWNER/$REPO/collaborators/$LOGIN/permission" 2>&1 || true)
          echo "$RESP"
          if echo "$RESP" | grep -q '404'; then
            echo "Not a collaborator (404), repository access may be restricted or PAT not authorized to org"
          elif echo "$RESP" | grep -q '"permission":"write"'; then
            echo "permission ok: write"
          elif echo "$RESP" | grep -q '"permission":"admin"'; then
            echo "permission ok: admin"
          else
            echo "permission insufficient: $RESP"
          fi

      - name: Create tag and GitHub Release
        if: steps.meta.outputs.skip != 'true' && steps.exist.outputs.skip != 'true' && steps.body.outputs.has_body == 'true'
        env:
          VERSION: ${{ steps.meta.outputs.version }}
          GH_TOKEN: ${{ secrets.CREATE_TAG_RELEASE_TOKEN }}
        run: |
          set -euo pipefail
          TAG="v${VERSION}"

          git fetch origin main:refs/remotes/origin/main --depth=1
          MAIN_SHA="$(git rev-parse origin/main)"

          echo "Creating tag ${TAG} at ${MAIN_SHA}"
          git tag "${TAG}" "${MAIN_SHA}"
          git push origin "${TAG}"

          echo "Creating GitHub Release ${TAG}"
          gh release create "${TAG}" \
            --target "main" \
            --title "${TAG}" \
            --notes-file "release-body.md"