provenance.yml

name: 📦 Publish

concurrency:
  group: publish-${{ github.ref }}
  cancel-in-progress: false

on:
  workflow_dispatch:
    inputs:
      dry-run:
        description: 'Dry run (build only)'
        type: boolean
        default: true
      cli:
        description: '@socketsecurity/cli'
        type: boolean
        default: true
      cli-sentry:
        description: '@socketsecurity/cli-with-sentry'
        type: boolean
        default: true
      socket:
        description: 'socket (+ 8 bins)'
        type: boolean
        default: true
      iocraft:
        description: '@socketaddon/iocraft (+ 8 platforms)'
        type: boolean
        default: false

permissions:
  contents: read

env:
  BUILD_MODE: prod

jobs:
  # Build CLI bundle once (platform-agnostic JS) and generate platform matrix.
  build-cli:
    if: ${{ inputs.socket }}
    name: Build CLI bundle
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      matrix: ${{ steps.matrix.outputs.matrix }}

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version-file: .node-version
          cache: 'pnpm'
          cache-dependency-path: 'pnpm-lock.yaml'

      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0

      - run: pnpm install --frozen-lockfile

      - name: Build CLI
        run: pnpm --filter @socketsecurity/cli run build

      - name: Generate platform matrix
        id: matrix
        run: |
          MATRIX=$(node scripts/get-platform-matrix.mjs)
          echo "matrix=$MATRIX" >> $GITHUB_OUTPUT

      - name: Upload CLI bundle
        uses: actions/upload-artifact@ea165f8ff5e4e9264e1c76a100385dcb87c2b141 # v4.4.3
        with:
          name: cli-bundle
          path: packages/cli/build/cli.js
          retention-days: 1

  # Build SEA binaries for all platforms (only if publishing binaries).
  build-binaries:
    if: ${{ inputs.socket }}
    needs: [build-cli]
    name: Build ${{ matrix.releasePlatform }}-${{ matrix.arch }}${{ matrix.libc && '-musl' || '' }}
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.build-cli.outputs.matrix) }}

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version-file: .node-version
          cache: 'pnpm'
          cache-dependency-path: 'pnpm-lock.yaml'
          registry-url: 'https://registry.npmjs.org'

      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0

      - run: pnpm install --frozen-lockfile

      - name: Download CLI bundle
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: cli-bundle
          path: packages/cli/build

      - name: Build SEA binary
        shell: bash
        run: |
          LIBC_FLAG=""
          if [ "${{ matrix.libc }}" = "musl" ]; then
            LIBC_FLAG="--libc=musl"
          fi
          pnpm --filter @socketsecurity/cli run build:sea -- \
            --platform=${{ matrix.platform }} \
            --arch=${{ matrix.arch }} \
            ${LIBC_FLAG}

      - name: Upload binary
        uses: actions/upload-artifact@ea165f8ff5e4e9264e1c76a100385dcb87c2b141 # v4.4.3
        with:
          name: binary-${{ matrix.releasePlatform }}-${{ matrix.arch }}${{ matrix.libc && '-musl' || '' }}
          path: packages/package-builder/build/prod/out/socketbin-cli-${{ matrix.releasePlatform }}-${{ matrix.arch }}${{ matrix.libc && '-musl' || '' }}/socket${{ matrix.platform == 'win32' && '.exe' || '' }}
          retention-days: 1

  # Publish all packages.
  publish:
    name: Publish packages
    needs: [build-cli, build-binaries]
    if: ${{ always() && (needs.build-cli.result == 'success' || needs.build-cli.result == 'skipped') && (needs.build-binaries.result == 'success' || needs.build-binaries.result == 'skipped') }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version-file: .node-version
          cache: 'pnpm'
          cache-dependency-path: 'pnpm-lock.yaml'
          registry-url: 'https://registry.npmjs.org'

      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0

      - run: pnpm install --frozen-lockfile

      - run: npm install -g npm@latest

      # Get versions for lock-stepped and independent packages.
      - name: Get versions
        id: version
        run: |
          # Socket CLI ecosystem version (lock-stepped)
          CLI_VERSION=$(node -p "require('./packages/package-builder/templates/cli-package/package.json').version")
          echo "cli_version=$CLI_VERSION" >> $GITHUB_OUTPUT
          echo "Socket CLI version: $CLI_VERSION"

          # iocraft ecosystem version (independent)
          IOCRAFT_VERSION=$(node -p "require('./packages/package-builder/templates/socketaddon-main/package.json').version")
          echo "iocraft_version=$IOCRAFT_VERSION" >> $GITHUB_OUTPUT
          echo "iocraft version: $IOCRAFT_VERSION"

          # Determine npm dist-tags based on versions
          if [[ "$CLI_VERSION" =~ -pre\. ]]; then
            CLI_TAG="pre"
          else
            CLI_TAG="latest"
          fi
          echo "cli_tag=$CLI_TAG" >> $GITHUB_OUTPUT
          echo "Socket CLI dist-tag: $CLI_TAG"

          if [[ "$IOCRAFT_VERSION" =~ -pre\. ]]; then
            IOCRAFT_TAG="pre"
          else
            IOCRAFT_TAG="latest"
          fi
          echo "iocraft_tag=$IOCRAFT_TAG" >> $GITHUB_OUTPUT
          echo "iocraft dist-tag: $IOCRAFT_TAG"

      # Download and publish binary packages.
      - name: Download binaries
        if: ${{ inputs.socket }}
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          path: artifacts
          pattern: binary-*

      - name: Publish binary packages
        if: ${{ inputs.socket && !inputs.dry-run }}
        env:
          VERSION: ${{ steps.version.outputs.cli_version }}
          TAG: ${{ steps.version.outputs.cli_tag }}
        run: |
          set -euo pipefail

          # Get platform targets from single source of truth.
          PLATFORMS_STR=$(node scripts/get-platform-targets.mjs)
          read -ra PLATFORMS <<< "$PLATFORMS_STR"

          for target in "${PLATFORMS[@]}"; do
            echo "::group::Publishing @socketbin/cli-${target}"

            # Parse platform/arch/libc from target.
            IFS='-' read -ra PARTS <<< "$target"
            PLATFORM="${PARTS[0]}"
            ARCH="${PARTS[1]}"
            LIBC=""
            if [ "${PARTS[2]}" = "musl" ]; then
              LIBC="musl"
            fi

            # Setup package directory.
            PKG_DIR="packages/package-builder/build/prod/out/socketbin-cli-${target}"
            mkdir -p "$PKG_DIR"

            # Copy binary from artifact.
            # Check for 'win' (release naming, not win32).
            if [ "$PLATFORM" = "win" ]; then
              cp "artifacts/binary-${target}/socket.exe" "$PKG_DIR/"
            else
              cp "artifacts/binary-${target}/socket" "$PKG_DIR/"
            fi

            # Prepare package.
            LIBC_FLAG=""
            if [ -n "$LIBC" ]; then
              LIBC_FLAG="--libc=$LIBC"
            fi
            node scripts/prepublish-socketbin.mjs \
              --platform="$PLATFORM" --arch="$ARCH" $LIBC_FLAG --prod \
              --version="$VERSION" --method=sea

            # Publish.
            cd "$PKG_DIR"
            npm publish --provenance --access public --tag "$TAG"
            cd -

            echo "::endgroup::"
          done

      # Build and publish JS packages.
      # Order: cli/cli-with-sentry first (independent), then socket (depends on @socketbin/*).
      - name: Build CLI
        run: INLINED_SOCKET_CLI_PUBLISHED_BUILD=1 pnpm run build

      - name: Publish @socketsecurity/cli
        if: ${{ inputs.cli && !inputs.dry-run }}
        env:
          VERSION: ${{ steps.version.outputs.cli_version }}
          TAG: ${{ steps.version.outputs.cli_tag }}
        run: |
          PKG_DIR="packages/package-builder/build/prod/out/cli"
          node scripts/prepare-package-for-publish.mjs "$PKG_DIR" "$VERSION"
          cd "$PKG_DIR"
          npm publish --provenance --access public --no-git-checks --tag "$TAG"

      - name: Publish @socketsecurity/cli-with-sentry
        if: ${{ inputs.cli-sentry && !inputs.dry-run }}
        env:
          VERSION: ${{ steps.version.outputs.cli_version }}
          TAG: ${{ steps.version.outputs.cli_tag }}
        run: |
          PKG_DIR="packages/package-builder/build/prod/out/cli-with-sentry"
          node scripts/prepare-package-for-publish.mjs "$PKG_DIR" "$VERSION"
          cd "$PKG_DIR"
          npm publish --provenance --access public --no-git-checks --tag "$TAG"

      # socket published last - depends on @socketbin/* being published first.
      - name: Publish socket
        if: ${{ inputs.socket && !inputs.dry-run }}
        env:
          VERSION: ${{ steps.version.outputs.cli_version }}
          TAG: ${{ steps.version.outputs.cli_tag }}
        run: |
          PKG_DIR="packages/package-builder/build/prod/out/socket"
          node scripts/prepare-package-for-publish.mjs "$PKG_DIR" "$VERSION"
          cd "$PKG_DIR"
          npm publish --provenance --access public --no-git-checks --tag "$TAG"

      # Download iocraft binaries from socket-btm.
      - name: Download iocraft binaries
        if: ${{ inputs.iocraft }}
        run: |
          echo "Downloading iocraft .node binaries for all platforms..."
          node scripts/download-iocraft-binaries.mjs

      # Copy iocraft binaries to package directories.
      - name: Copy iocraft binaries to packages
        if: ${{ inputs.iocraft }}
        run: |
          set -euo pipefail

          # Get platform targets from single source of truth.
          PLATFORMS_STR=$(node scripts/get-platform-targets.mjs)
          read -ra PLATFORMS <<< "$PLATFORMS_STR"

          for target in "${PLATFORMS[@]}"; do
            echo "Copying iocraft.node for ${target}..."

            # Source path (downloaded binary).
            SRC_PATH="packages/build-infra/build/downloaded/iocraft/${target}/iocraft.node"

            # Destination path (package directory).
            PKG_DIR="packages/package-builder/build/prod/out/socketaddon-iocraft-${target}"
            mkdir -p "$PKG_DIR"
            cp "$SRC_PATH" "$PKG_DIR/iocraft.node"

            echo "Copied to ${PKG_DIR}/iocraft.node"
          done

      # Publish @socketaddon/iocraft packages (main + platform-specific).
      - name: Publish @socketaddon/iocraft main package
        if: ${{ inputs.iocraft && !inputs.dry-run }}
        env:
          VERSION: ${{ steps.version.outputs.iocraft_version }}
          TAG: ${{ steps.version.outputs.iocraft_tag }}
        run: |
          PKG_DIR="packages/package-builder/build/prod/out/socketaddon-iocraft"
          node scripts/prepare-package-for-publish.mjs "$PKG_DIR" "$VERSION"
          cd "$PKG_DIR"
          npm publish --provenance --access public --no-git-checks --tag "$TAG"

      - name: Publish @socketaddon/iocraft platform packages
        if: ${{ inputs.iocraft && !inputs.dry-run }}
        env:
          VERSION: ${{ steps.version.outputs.iocraft_version }}
          TAG: ${{ steps.version.outputs.iocraft_tag }}
        run: |
          set -euo pipefail

          # Get platform targets from single source of truth.
          PLATFORMS_STR=$(node scripts/get-platform-targets.mjs)
          read -ra PLATFORMS <<< "$PLATFORMS_STR"

          for target in "${PLATFORMS[@]}"; do
            echo "::group::Publishing @socketaddon/iocraft-${target}"

            PKG_DIR="packages/package-builder/build/prod/out/socketaddon-iocraft-${target}"

            # Prepare package.
            node scripts/prepare-package-for-publish.mjs "$PKG_DIR" "$VERSION"

            # Publish.
            cd "$PKG_DIR"
            npm publish --provenance --access public --no-git-checks --tag "$TAG"
            cd -

            echo "::endgroup::"
          done

      - name: Summary
        run: |
          echo "## Publish Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          if [ "${{ inputs.socket }}" = "true" ] || [ "${{ inputs.cli }}" = "true" ] || [ "${{ inputs.cli-sentry }}" = "true" ]; then
            echo "Socket CLI version: \`${{ steps.version.outputs.cli_version }}\` (tag: \`${{ steps.version.outputs.cli_tag }}\`)" >> $GITHUB_STEP_SUMMARY
          fi
          if [ "${{ inputs.iocraft }}" = "true" ]; then
            echo "iocraft version: \`${{ steps.version.outputs.iocraft_version }}\` (tag: \`${{ steps.version.outputs.iocraft_tag }}\`)" >> $GITHUB_STEP_SUMMARY
          fi
          echo "" >> $GITHUB_STEP_SUMMARY
          if [ "${{ inputs.dry-run }}" = "true" ]; then
            echo "**Dry run - nothing was published**" >> $GITHUB_STEP_SUMMARY
          else
            echo "### Published packages:" >> $GITHUB_STEP_SUMMARY
            if [ "${{ inputs.socket }}" = "true" ]; then
              echo "- @socketbin/cli-* (8 platforms)" >> $GITHUB_STEP_SUMMARY
            fi
            if [ "${{ inputs.socket }}" = "true" ]; then
              echo "- socket" >> $GITHUB_STEP_SUMMARY
            fi
            if [ "${{ inputs.cli }}" = "true" ]; then
              echo "- @socketsecurity/cli" >> $GITHUB_STEP_SUMMARY
            fi
            if [ "${{ inputs.cli-sentry }}" = "true" ]; then
              echo "- @socketsecurity/cli-with-sentry" >> $GITHUB_STEP_SUMMARY
            fi
            if [ "${{ inputs.iocraft }}" = "true" ]; then
              echo "- @socketaddon/iocraft (main)" >> $GITHUB_STEP_SUMMARY
              echo "- @socketaddon/iocraft-* (8 platforms)" >> $GITHUB_STEP_SUMMARY
            fi
          fi