release.yml

name: Release

on:
  push:
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: write
  id-token: write

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org
          # Never restore a cache in a release build: the published artefact
          # should come from exactly what is in the tag.
          cache: ""

      - run: npm ci
      - run: npm run check
      - run: npm run build

      # The release body is bilingual: this version's section from CHANGELOG.md
      # and CHANGELOG.zh-CN.md, the install line, and the curated contributor
      # list. GitHub's generated notes (PR list, compare link) are appended by
      # the release step. This runs before publishing so a missing section
      # stops the release before npm.
      - name: Build release notes
        run: |
          version=$(node -p "require('./package.json').version")
          section() {
            awk -v v="$version" '
              /^## / { if (found) exit; if ($2 == v) { found = 1; next } }
              found { print }
            ' "$1"
          }
          section CHANGELOG.md > en.md
          section CHANGELOG.zh-CN.md > zh.md
          for f in en.md zh.md; do
            if ! grep -q '[^[:space:]]' "$f"; then
              echo "::error::No '## ${version}' section for ${f} (CHANGELOG.md / CHANGELOG.zh-CN.md)."
              exit 1
            fi
          done

          # Contributors are curated in the CHANGELOG's "### Contributors" block,
          # not derived from commit authors: that would list the maintainer and
          # miss people who reported or diagnosed a bug without committing. The
          # block appears once, in English, at the end of the release body.
          awk '/^### Contributors/ { c = 1; next } /^### / { c = 0 } c' en.md > contributors.md
          for f in en.md zh.md; do
            awk '/^### Contributors/ { c = 1; next } /^### / { c = 0 } !c' "$f" > "$f.tmp" && mv "$f.tmp" "$f"
          done

          {
            echo "## English"
            cat en.md
            echo ""
            echo "## 简体中文"
            cat zh.md
            echo ""
            echo "## Install"
            echo '```bash'
            echo "npm install -g opencode-github-sync@${version}"
            echo '```'
            echo ""
            echo "Plugin users: OpenCode picks up the new version on its next start."
            if grep -q '[^[:space:]]' contributors.md; then
              echo ""
              echo "## Contributors"
              echo ""
              echo "Thank you to everyone who made this release possible:"
              echo ""
              grep '[^[:space:]]' contributors.md
            fi
          } > RELEASE_NOTES.md
          cat RELEASE_NOTES.md

      # A re-run of a release, or a tag pushed after publishing by hand, must not
      # fail the whole workflow. npm rejects republishing a version, so check
      # first and let the GitHub release step still run.
      - name: Check whether this version is already on npm
        id: published
        run: |
          version=$(node -p "require('./package.json').version")
          if npm view "opencode-github-sync@${version}" version >/dev/null 2>&1; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
            echo "::notice::opencode-github-sync@${version} is already published; skipping npm publish."
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
          fi

      # Publishing uses a granular token with the 2FA bypass enabled, since the
      # account's second factor is a passkey and cannot produce an OTP for CI.
      #
      # npm has announced that 2FA-bypass tokens lose direct publishing around
      # January 2027 (https://gh.io/npm-gat-bypass2fa-deprecation). Before then
      # this should move to trusted publishing (OIDC), which needs no secret at
      # all: configure it at npmjs.com/package/opencode-github-sync/access, then
      # delete both the NPM_TOKEN secret and the env block below.
      - name: Publish to npm
        if: steps.published.outputs.exists == 'false'
        run: npm publish --access public --provenance
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Create the GitHub release
        uses: softprops/action-gh-release@v2
        with:
          body_path: RELEASE_NOTES.md
          generate_release_notes: true