release.yml

name: Release

# Runs on every push to main except the version-bump commit this workflow
# produces, preventing an infinite loop.
on:
  push:
    branches: [main]

jobs:
  release:
    if: "!startsWith(github.event.head_commit.message, 'chore: release')"
    runs-on: ubuntu-latest
    permissions:
      contents: write # push version bump + tag, create release
      packages: write # push Docker image to ghcr.io

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # full history so we can inspect commits since last tag

      - uses: pnpm/action-setup@v4
        with:
          version: 10

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - run: pnpm install --frozen-lockfile

      # Inspect commit messages since the last tag (or all commits if no tag
      # yet) and pick a semver bump level using conventional commits:
      #   BREAKING CHANGE or ! suffix → major
      #   feat: → minor
      #   anything else → patch
      - name: Determine version bump
        id: semver
        run: |
          LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")

          if [ -z "$LATEST_TAG" ]; then
            COMMITS=$(git log --pretty=format:"%s%n%b")
          else
            COMMITS=$(git log "${LATEST_TAG}..HEAD" --pretty=format:"%s%n%b")
          fi

          BUMP="patch"
          while IFS= read -r line; do
            if echo "$line" | grep -qE "BREAKING[- ]CHANGE|^[a-z]+(\(.+\))?!:"; then
              BUMP="major"
              break
            elif echo "$line" | grep -qE "^feat(\(.+\))?:"; then
              if [ "$BUMP" = "patch" ]; then BUMP="minor"; fi
            fi
          done <<< "$COMMITS"

          echo "bump=$BUMP" >> "$GITHUB_OUTPUT"

      - name: Bump version in package.json
        id: version
        run: |
          NEW_VERSION=$(npm version ${{ steps.semver.outputs.bump }} --no-git-tag-version)
          echo "new_version=$NEW_VERSION" >> "$GITHUB_OUTPUT"

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: |
            ghcr.io/${{ github.repository }}:${{ steps.version.outputs.new_version }}
            ghcr.io/${{ github.repository }}:latest

      # Commit the package.json bump, tag it, and push. Requires that the
      # github-actions bot is allowed to push to main (configure via branch
      # protection → "Allow specific actors to bypass required pull requests").
      - name: Commit, tag, and push
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add package.json
          git commit -m "chore: release ${{ steps.version.outputs.new_version }}"
          git tag -a "${{ steps.version.outputs.new_version }}" -m "Release ${{ steps.version.outputs.new_version }}"
          git push origin main --follow-tags

      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create "${{ steps.version.outputs.new_version }}" \
            --title "${{ steps.version.outputs.new_version }}" \
            --generate-notes