name: Release - Bump Version and Open PR

on:
  workflow_dispatch:
    inputs:
      version_strategy:
        type: choice
        description: Version strategy
        options:
          - patch
          - minor
          - major
          - prerelease
          - premajor
          - preminor
          - prepatch
      dry_run:
        description: 'Dry run (preview only, no branch/commit/PR)'
        required: false
        default: false
        type: boolean

permissions:
  contents: write
  pull-requests: write

jobs:
  bump:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout main
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 24

      - name: Configure git
        run: |
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git config user.name "github-actions[bot]"

      - name: Dry-run preview
        if: ${{ github.event.inputs.dry_run == 'true' }}
        run: |
          CURRENT=$(node -p "require('./package.json').version")
          echo "Would bump @wix/agent-skills from $CURRENT using strategy: ${{ github.event.inputs.version_strategy }}"
          echo "All plugin manifests (.claude-plugin, .codex-plugin, .cursor-plugin, plugin.json, gemini-extension.json) would be synced to the new version."

      - name: Bump version
        if: ${{ github.event.inputs.dry_run == 'false' }}
        id: bump
        run: |
          npm version ${{ github.event.inputs.version_strategy }} --no-git-tag-version
          NEW_VERSION="v$(node -p "require('./package.json').version")"
          echo "version=${NEW_VERSION}" >> $GITHUB_OUTPUT
          echo "branch=release/${NEW_VERSION}" >> $GITHUB_OUTPUT

      - name: Create release branch and commit
        if: ${{ github.event.inputs.dry_run == 'false' }}
        run: |
          git checkout -b ${{ steps.bump.outputs.branch }}
          git add package.json
          git commit -m "chore: release @wix/agent-skills ${{ steps.bump.outputs.version }}"
          git push -u origin ${{ steps.bump.outputs.branch }}

      - name: Ensure release label exists
        if: ${{ github.event.inputs.dry_run == 'false' }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh label create release \
            --color "0E8A16" \
            --description "Merging publishes to npm" \
            --force

      - name: Open release PR
        if: ${{ github.event.inputs.dry_run == 'false' }}
        id: pr
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ steps.bump.outputs.version }}
          BRANCH: ${{ steps.bump.outputs.branch }}
        run: |
          BODY=$(cat <<EOF
          Automated release PR for **${VERSION}**.

          When required checks pass, this PR auto-merges and \`release.yml\` publishes to npm via Trusted Publishing and pushes the \`${VERSION}\` tag.
          EOF
          )
          PR_URL=$(gh pr create \
            --base main \
            --head "${BRANCH}" \
            --title "chore: release @wix/agent-skills ${VERSION}" \
            --body "${BODY}" \
            --label release)
          echo "url=${PR_URL}" >> $GITHUB_OUTPUT

      - name: Mint App token (used for approval + auto-merge so events propagate)
        if: ${{ github.event.inputs.dry_run == 'false' }}
        id: app-token
        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
        with:
          app-id: ${{ secrets.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

      - name: Approve the PR (App identity ≠ PR author)
        if: ${{ github.event.inputs.dry_run == 'false' }}
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          PR_URL: ${{ steps.pr.outputs.url }}
        run: gh pr review --approve "${PR_URL}" --body "Automated approval for release PR."

      - name: Enable auto-merge
        if: ${{ github.event.inputs.dry_run == 'false' }}
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          PR_URL: ${{ steps.pr.outputs.url }}
        run: gh pr merge --auto --squash "${PR_URL}"