release.yml

name: Release
run-name: "Release — ${{ inputs.bump-type || 'auto' }} from main${{ inputs.dry-run && ' (dry run)' || '' }}"

on:
  schedule:
    - cron: '0 15 * * 2' # Tuesday 3pm UTC
  workflow_dispatch:
    inputs:
      bump-type:
        description: 'Version bump type (auto, patch, minor)'
        type: string
        required: false
        default: 'auto'
      skip-checks:
        description: 'Skip CI status check verification'
        type: boolean
        default: false
      dry-run:
        description: 'Dry run (version bump without push)'
        type: boolean
        default: false
      packages-only:
        description: 'Packages-only: version pending changesets without releasing Ghost (does not publish — run the Publish Packages workflow after)'
        type: boolean
        default: false

env:
  FORCE_COLOR: 1
  NODE_VERSION: 22.23.3
concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

# The release job pushes via an SSH deploy key and authenticates to the
# GitHub API with a PAT, so the default GITHUB_TOKEN only needs read access.
permissions:
  contents: read

jobs:
  release:
    if: github.repository == 'TryGhost/Ghost'
    runs-on: ubuntu-latest
    name: Prepare & Push Release
    steps:
      - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
        with:
          ssh-private-key: ${{ secrets.DEPLOY_KEY }}

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          # Deploy key (via ssh-agent) is used for git push — it bypasses
          # branch protection and triggers downstream workflows (unlike GITHUB_TOKEN)
          #
          # Pinned to main, not a dispatch input: this job runs the checked-out
          # scripts/release.js with the deploy key and PAT loaded, so a
          # releasable ref must be one that went through review.
          ref: main
          fetch-depth: 0
          ssh-key: ${{ secrets.DEPLOY_KEY }}

      # Fetch submodules separately via HTTPS — the deploy key is scoped to
      # Ghost only and can't authenticate against Casper/Source over SSH
      - run: git submodule update --init

      - uses: ./.github/actions/setup-node-pnpm
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Set up Git
        run: |
          git config user.name "Ghost CI"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

      - name: Run release script
        run: node scripts/release.js
        env:
          # release.js reads these RELEASE_* vars as its arg defaults. inputs.*
          # are empty on the schedule trigger, so fall back to the
          # scheduled-release defaults (auto / no flags).
          RELEASE_BRANCH: main
          RELEASE_BUMP_TYPE: ${{ inputs.bump-type || 'auto' }}
          RELEASE_DRY_RUN: ${{ inputs.dry-run || 'false' }}
          RELEASE_SKIP_CHECKS: ${{ inputs.skip-checks || 'false' }}
          RELEASE_PACKAGES_ONLY: ${{ inputs.packages-only || 'false' }}
          GITHUB_TOKEN: ${{ secrets.CANARY_DOCKER_BUILD }} # PAT for GitHub API (check polling)

      - name: Notify Slack on release failure
        if: failure()
        env:
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          RELEASE_NOTIFICATION_URL: ${{ secrets.RELEASE_NOTIFICATION_URL }}
        run: |
          VALUE=$(printf '<!subteam^S07ATDH3CLB|on-call-product> — check the failed run: <%s|view run>' "$RUN_URL")
          PAYLOAD=$(jq -n --arg value "$VALUE" \
            '{username: "Ghost CI", attachments: [{color: "danger", fields: [{title: "🚨 Ghost release failed", value: $value}]}]}')
          curl -sf -X POST -H 'Content-type: application/json' \
            --data "$PAYLOAD" \
            "$RELEASE_NOTIFICATION_URL" || echo "Slack notification failed (non-fatal)"