name: release-please

on:
  push:
    branches:
      - main
  # Enable manual execution via "Run workflow" button in browser
  workflow_dispatch:
    inputs:
      branch:
        description: "Target branch name (uses current ref if not specified)"
        required: false

permissions:
  actions: write
  checks: read
  contents: write
  pull-requests: write
  issues: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: 📥 Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ github.event.inputs.branch || github.ref_name }}
          fetch-depth: 0 # Required for tag fetching

      - name: 🎯 Resolve target branch
        id: target
        env:
          INPUT_BRANCH: ${{ github.event.inputs.branch }}
        run: |
          TARGET_BRANCH="${INPUT_BRANCH:-${GITHUB_REF_NAME}}"
          case "${TARGET_BRANCH}" in
            main|v3-beta)
              ;;
            *)
              echo "This release workflow only supports main and v3-beta." >&2
              exit 1
              ;;
          esac

          TARGET_SHA="$(git rev-parse HEAD)"
          echo "branch=${TARGET_BRANCH}" >> "$GITHUB_OUTPUT"
          echo "sha=${TARGET_SHA}" >> "$GITHUB_OUTPUT"

      - name: Setup Go for release automation
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
        with:
          go-version-file: cli/.go-version
          cache-dependency-path: '**/go.sum'

      # release-please rebuilds every release pull request from the manifest at
      # HEAD and looks the previous release up by tag. While a version the
      # manifest names has no published release yet (a merged release pull
      # request whose publish is still pending), that rebuild would carry the
      # previous changelog entries again (#1088), so the run waits until every
      # named release is out. The publish workflows dispatch this workflow once
      # their release is published, which is what lets the remaining release
      # pull requests be rebuilt after a release commit.
      - name: 🧭 Decide whether every manifest release is published
        id: release_commit
        working-directory: cli/release-automation
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          TARGET_SHA: ${{ steps.target.outputs.sha }}
        run: go run ./cmd/check-release-please-gate --repo "${GITHUB_REPOSITORY}" --ref "${TARGET_SHA}" >> "$GITHUB_OUTPUT"

      # ── Debug: Show repository structure ─────────────────────────
      - name: 🕵️ Show file tree
        run: |
          echo "PWD: $(pwd)"
          echo "===== ls -R ====="
          ls -R

      # ── Sanity check for package.json files ─────────
      - name: 🧪 Sanity check
        run: |
          test -f Packages/src/package.json && echo "✅ Unity package.json OK"

      - name: 🏷️ Sync published release PR labels
        if: steps.release_commit.outputs.skip != 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TARGET_BRANCH: ${{ steps.target.outputs.branch }}
          GITHUB_REPOSITORY: ${{ github.repository }}
        run: scripts/sync-published-release-pr-labels.sh

      # ── Execute release-please ───────────────────────────
      - name: 🚀 Run release‑please
        if: steps.release_commit.outputs.skip != 'true'
        id: release
        uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071
        with:
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json
          target-branch: ${{ steps.target.outputs.branch }}
          skip-github-release: true
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Dispatch release PR checks
        id: release_pr_checks
        if: steps.target.outputs.branch == 'main' && steps.release_commit.outputs.skip != 'true' && steps.release.outputs.prs_created == 'true'
        working-directory: cli/release-automation
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TARGET_BRANCH: ${{ steps.target.outputs.branch }}
          GITHUB_REPOSITORY: ${{ github.repository }}
        run: go run ./cmd/dispatch-release-please-pr-checks

      # A merge made with GITHUB_TOKEN starts no follow-up workflow run, so the
      # package release would never be tagged; the App token is what makes the
      # merge observable to release-please
      # (docs/adr/0007-separate-release-prs-and-package-auto-merge.md).
      # The dispatch step above fails when any component's checks fail, and a
      # failing runner release must not strand a package-only release, so these
      # steps also run after that failure. The merge helper verifies the package
      # head's own runs, so another component's failure cannot make it merge
      # something unchecked.
      - name: Mint package release merge token
        id: package-merge-token
        if: steps.target.outputs.branch == 'main' && steps.release_commit.outputs.skip != 'true' && steps.release.outputs.prs_created == 'true' && !cancelled() && (steps.release_pr_checks.outcome == 'success' || steps.release_pr_checks.outcome == 'failure')
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
        with:
          app-id: ${{ vars.DISPATCHER_PIN_APP_ID }}
          private-key: ${{ secrets.DISPATCHER_PIN_APP_PRIVATE_KEY }}
          permission-contents: write
          permission-pull-requests: write

      # This step leaves the package release pull request draft while a
      # dispatcher release pull request is open, and while the pin at its head
      # still disagrees with the dispatcher version the base branch manifest
      # releases. Both windows would otherwise ship a package that pins an
      # older dispatcher than the one main is about to release. The checks grace
      # covers the run listing lagging the completion the previous step just
      # watched; without it a green head is left draft until the next push.
      - name: Merge the Unity package release pull request when no dispatcher release is pending
        if: steps.target.outputs.branch == 'main' && steps.release_commit.outputs.skip != 'true' && steps.release.outputs.prs_created == 'true' && !cancelled() && (steps.release_pr_checks.outcome == 'success' || steps.release_pr_checks.outcome == 'failure')
        working-directory: cli/release-automation
        env:
          GH_TOKEN: ${{ steps.package-merge-token.outputs.token }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          TARGET_BRANCH: ${{ steps.target.outputs.branch }}
        run: >-
          go run ./cmd/merge-package-release-pr
          --repo "${GITHUB_REPOSITORY}"
          --base-branch "${TARGET_BRANCH}"
          --require-no-open-dispatcher-pr
          --no-wait
          --checks-grace-seconds 120