swift-release.yml

name: Swift Release

# Releases the Swift client, versioned with Changesets (see .changeset/README.md).
# The zero-swift npm package (packages/zero-swift-cli) and the Swift package
# (swift/) share one version, kept in step by `pnpm --filter zero-swift version-packages`.
#
# On each push to main:
# - With pending changesets, opens or updates the "Version Packages" PR.
# - Otherwise, if the version in swift/VERSION isn't released yet, after
#   approval in the swift-release environment:
#   - publishes swift/ to the SwiftPM mirror (wevm/zero-swift), tags the
#     version there, and creates a GitHub release from the version's section
#     of packages/zero-swift-cli/CHANGELOG.md. SwiftPM needs Package.swift at
#     a repository root and clones whole repositories, so consumers install
#     from the mirror.
#   - publishes the zero-swift CLI to npm with trusted publishing.
# Each step is skipped when its release already exists, so a failed run can be
# rerun.

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: swift-release
  cancel-in-progress: false

jobs:
  version:
    name: Version PR
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    outputs:
      has-changesets: ${{ steps.changesets.outputs.has-changesets }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
          version: 11.11.0
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .nvmrc
          package-manager-cache: false
      - run: pnpm install --frozen-lockfile
      - id: changesets
        uses: changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2
        with:
          # One PR versions both clients: Rust Release (rust-release.yml)
          # has no version job of its own, since two would race for the
          # same changeset-release/main branch. The action runs the script
          # without a shell (@actions/exec), so `&&` needs `sh -c`.
          version-script: sh -c "pnpm --filter zero-swift version-packages && pnpm --filter zero-rust sync-version"
          commit-message: 'chore: version packages'
          pr-title: 'chore: version packages'

  plan:
    name: Plan release
    runs-on: ubuntu-latest
    needs: version
    if: needs.version.outputs.has-changesets == 'false'
    outputs:
      version: ${{ steps.plan.outputs.version }}
      mirror: ${{ steps.plan.outputs.mirror }}
      release: ${{ steps.plan.outputs.release }}
      npm: ${{ steps.plan.outputs.npm }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          sparse-checkout: |
            swift/VERSION
            packages/zero-swift-cli/package.json
          sparse-checkout-cone-mode: false
      - id: plan
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          version="$(tr -d '[:space:]' < swift/VERSION)"
          package="$(jq -r .version packages/zero-swift-cli/package.json)"
          if [ "$package" != "$version" ]; then
            echo "packages/zero-swift-cli is $package but swift/VERSION is $version." >&2
            exit 1
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"
          # Only a 404 means unpublished: a failed lookup isn't a reason to
          # publish.
          status="$(curl -sS --retry 3 --retry-all-errors --output /dev/null --write-out '%{http_code}' \
            "https://registry.npmjs.org/zero-swift/$version")"
          case "$status" in
            200) echo "npm=false" >> "$GITHUB_OUTPUT" ;;
            404) echo "npm=true" >> "$GITHUB_OUTPUT" ;;
            *) echo "Looking up zero-swift@$version on npm returned HTTP $status." >&2; exit 1 ;;
          esac
          if git ls-remote --exit-code --tags https://github.com/wevm/zero-swift.git "refs/tags/$version" >/dev/null; then
            echo "mirror=false" >> "$GITHUB_OUTPUT"
          else
            echo "mirror=true" >> "$GITHUB_OUTPUT"
          fi
          status="$(curl -sS --retry 3 --retry-all-errors -o /dev/null -w '%{http_code}' -H "Authorization: Bearer $GH_TOKEN" \
            "https://api.github.com/repos/wevm/zero-swift/releases/tags/$version")"
          case "$status" in
            200) echo "release=false" >> "$GITHUB_OUTPUT" ;;
            404) echo "release=true" >> "$GITHUB_OUTPUT" ;;
            *) echo "Looking up the $version release returned HTTP $status." >&2; exit 1 ;;
          esac

  mirror:
    name: Publish mirror
    runs-on: ubuntu-latest
    needs: plan
    if: needs.plan.outputs.mirror == 'true' || needs.plan.outputs.release == 'true'
    environment: swift-release
    permissions:
      contents: read
      id-token: write # For the github-sts token exchange.
    env:
      MIRROR_REPO: wevm/zero-swift
      VERSION: ${{ needs.plan.outputs.version }}
    steps:
      # Short-lived token for the mirror, authorized by
      # swift/.github/sts/mirror.sts.yaml (published to the mirror's main).
      - name: Fetch mirror token
        id: sts
        uses: wevm/actions/.github/actions/github-sts@b518cf981b50a4c745a8b7335fc693f34b108a75 # main
        with:
          scope: wevm/zero-swift
          policy: mirror
          ttl: 5m
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Split and push
        if: needs.plan.outputs.mirror == 'true'
        env:
          MIRROR_TOKEN: ${{ steps.sts.outputs.token }}
        run: |
          set -euo pipefail
          git subtree split --prefix=swift -b mirror
          remote="https://x-access-token:${MIRROR_TOKEN}@github.com/${MIRROR_REPO}.git"
          git push "$remote" mirror:main
          git tag "$VERSION" mirror
          git push "$remote" "refs/tags/$VERSION"
      # The version's changelog section. Its commit hashes are wevm/zero's,
      # which GitHub doesn't link from the mirror, so they become links.
      - name: Create release
        env:
          GH_TOKEN: ${{ steps.sts.outputs.token }}
        run: |
          set -euo pipefail
          awk -v v="## $VERSION" '$0 == v {f = 1; next} /^## / {f = 0} f' \
            packages/zero-swift-cli/CHANGELOG.md |
            sed -E 's|^- ([0-9a-f]{7,40}):|- [`\1`](https://github.com/wevm/zero/commit/\1):|' \
            >"$RUNNER_TEMP/notes.md"
          if ! grep -q '[^[:space:]]' "$RUNNER_TEMP/notes.md"; then
            echo "No section for $VERSION in packages/zero-swift-cli/CHANGELOG.md." >&2
            exit 1
          fi
          gh release create "$VERSION" -R "$MIRROR_REPO" --verify-tag \
            --title "$VERSION" --notes-file "$RUNNER_TEMP/notes.md"

  npm-build:
    name: Build npm package
    runs-on: ubuntu-latest
    needs: plan
    if: needs.plan.outputs.npm == 'true'
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
          version: 11.11.0
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .nvmrc
          package-manager-cache: false
      - run: pnpm install --frozen-lockfile
      - name: Smoke test the packed CLI
        run: pnpm --filter zero-swift smoke
      - name: Build and pack
        run: |
          pnpm --filter zero-swift build
          pnpm --filter zero-swift pack --pack-destination "$GITHUB_WORKSPACE/dist/npm"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: zero-swift-npm
          path: dist/npm/*.tgz
          if-no-files-found: error

  npm-publish:
    name: Publish npm package
    runs-on: ubuntu-latest
    needs: [plan, npm-build]
    environment: swift-release
    permissions:
      contents: read
      id-token: write # For npm trusted publishing.
    env:
      VERSION: ${{ needs.plan.outputs.version }}
    steps:
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          registry-url: 'https://registry.npmjs.org'
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: zero-swift-npm
          path: dist/npm
      # npm makes a new version visible to the plan's lookup a minute or so after
      # the publish returns, so a run that plans right after the previous run's
      # publish can still choose to publish. The registry's refusal settles it.
      - name: Publish
        run: |
          set -uo pipefail
          npm publish "dist/npm/zero-swift-$VERSION.tgz" --provenance --access public 2>&1 | tee publish.log && exit 0
          if grep -q 'cannot publish over the previously published versions' publish.log; then
            echo "::notice::zero-swift@$VERSION is already on npm."
            exit 0
          fi
          exit 1