clawhub/.github/workflows/clawhub-cli-npm-release.yml

name: ClawHub CLI NPM Release

on:
  workflow_dispatch:
    inputs:
      tag:
        description: Release tag to publish, for example v0.10.0
        required: true
        type: string
      preflight_only:
        description: Run validation/build only and skip the gated publish job
        required: true
        default: false
        type: boolean
      preflight_run_id:
        description: Existing successful preflight workflow run id to promote without rebuilding
        required: false
        type: string

concurrency:
  group: clawhub-cli-npm-release-${{ inputs.tag }}
  cancel-in-progress: false

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
  NODE_VERSION: "24.x"
  BUN_VERSION: "1.3.10"

jobs:
  preflight_clawhub_cli_npm:
    if: ${{ inputs.preflight_only }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Forbid preflight artifact promotion on validation-only runs
        if: ${{ inputs.preflight_run_id != '' }}
        run: |
          echo "preflight_run_id is only valid for real publish runs."
          exit 1

      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: refs/tags/${{ inputs.tag }}
          fetch-depth: 0

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          registry-url: https://registry.npmjs.org

      - name: Setup Bun
        uses: oven-sh/setup-bun@e3914758a49697077f7bcd190d36582a61667aad
        with:
          bun-version: ${{ env.BUN_VERSION }}

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Resolve CLI package directory
        run: |
          set -euo pipefail
          if [[ -d "packages/clawhub" ]]; then
            echo "PACKAGE_DIR=packages/clawhub" >> "$GITHUB_ENV"
          elif [[ -d "packages/clawdhub" ]]; then
            echo "PACKAGE_DIR=packages/clawdhub" >> "$GITHUB_ENV"
          else
            echo "Unable to find clawhub CLI package directory." >&2
            exit 1
          fi

      - name: Ensure version is not already published
        env:
          PREFLIGHT_ONLY: ${{ inputs.preflight_only }}
        run: |
          set -euo pipefail
          PACKAGE_VERSION="$(node --input-type=module <<'EOF'
          import { readFileSync } from "node:fs";

          const pkg = JSON.parse(readFileSync(`./${process.env.PACKAGE_DIR}/package.json`, "utf8"));
          process.stdout.write(String(pkg.version ?? "").trim());
          EOF
          )"

          if npm view "clawhub@${PACKAGE_VERSION}" version >/dev/null 2>&1; then
            if [[ "${PREFLIGHT_ONLY}" == "true" ]]; then
              echo "clawhub@${PACKAGE_VERSION} is already published on npm; continuing because preflight_only=true."
              exit 0
            fi
            echo "clawhub@${PACKAGE_VERSION} is already published on npm."
            exit 1
          fi

          echo "Publishing clawhub@${PACKAGE_VERSION}"

      - name: Validate release tag and package metadata
        env:
          RELEASE_TAG: ${{ inputs.tag }}
          RELEASE_MAIN_REF: origin/main
        run: |
          set -euo pipefail
          RELEASE_SHA="$(git rev-parse HEAD)"
          export RELEASE_SHA
          git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
          node scripts/clawhub-cli-npm-release-check.mjs

      - name: Verify CLI package
        run: bun run --cwd "$PACKAGE_DIR" verify

      - name: Pack prepared npm tarball
        id: packed_tarball
        env:
          RELEASE_TAG: ${{ inputs.tag }}
        run: |
          set -euo pipefail
          pushd "$PACKAGE_DIR" >/dev/null
          PACK_JSON="$(npm pack --json --ignore-scripts)"
          echo "$PACK_JSON"
          PACK_PATH="$(printf '%s\n' "$PACK_JSON" | node --input-type=module -e 'const chunks=[]; process.stdin.on("data", (chunk) => chunks.push(chunk)); process.stdin.on("end", () => { const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8")); const first = Array.isArray(parsed) ? parsed[0] : null; if (!first || typeof first.filename !== "string" || !first.filename) process.exit(1); process.stdout.write(first.filename); });')"
          popd >/dev/null
          if [[ -z "${PACK_PATH}" || ! -f "${PACKAGE_DIR}/${PACK_PATH}" ]]; then
            echo "npm pack did not produce a tarball file." >&2
            exit 1
          fi
          RELEASE_SHA="$(git rev-parse HEAD)"
          PACKAGE_VERSION="$(node --input-type=module <<'EOF'
          import { readFileSync } from "node:fs";

          const pkg = JSON.parse(readFileSync(`./${process.env.PACKAGE_DIR}/package.json`, "utf8"));
          process.stdout.write(String(pkg.version ?? "").trim());
          EOF
          )"
          ARTIFACT_DIR="$RUNNER_TEMP/clawhub-cli-npm-preflight"
          rm -rf "$ARTIFACT_DIR"
          mkdir -p "$ARTIFACT_DIR"
          cp "${PACKAGE_DIR}/${PACK_PATH}" "$ARTIFACT_DIR/"
          printf '%s\n' "$RELEASE_TAG" > "$ARTIFACT_DIR/release-tag.txt"
          printf '%s\n' "$RELEASE_SHA" > "$ARTIFACT_DIR/release-sha.txt"
          printf '%s\n' "$PACKAGE_VERSION" > "$ARTIFACT_DIR/package-version.txt"
          echo "dir=$ARTIFACT_DIR" >> "$GITHUB_OUTPUT"

      - name: Upload prepared npm publish bundle
        uses: actions/upload-artifact@v7
        with:
          name: clawhub-cli-npm-preflight-${{ inputs.tag }}
          path: ${{ steps.packed_tarball.outputs.dir }}
          if-no-files-found: error

  validate_publish_request:
    if: ${{ !inputs.preflight_only }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Require main workflow ref for publish
        env:
          WORKFLOW_REF: ${{ github.ref }}
        run: |
          set -euo pipefail
          if [[ "${WORKFLOW_REF}" != "refs/heads/main" ]]; then
            echo "Real publish runs must be dispatched from main. Use preflight_only=true for branch validation."
            exit 1
          fi

      - name: Require preflight artifact promotion on real publish
        env:
          PREFLIGHT_RUN_ID: ${{ inputs.preflight_run_id }}
        run: |
          set -euo pipefail
          if [[ -z "${PREFLIGHT_RUN_ID}" ]]; then
            echo "Real publish requires preflight_run_id from a successful npm preflight run." >&2
            exit 1
          fi

  publish_clawhub_cli_npm:
    needs: [validate_publish_request]
    if: ${{ !inputs.preflight_only }}
    runs-on: ubuntu-latest
    environment: npm-release
    permissions:
      actions: read
      contents: read
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: refs/tags/${{ inputs.tag }}
          fetch-depth: 0

      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version: ${{ env.NODE_VERSION }}
          registry-url: https://registry.npmjs.org

      - name: Resolve CLI package directory
        run: |
          set -euo pipefail
          if [[ -d "packages/clawhub" ]]; then
            echo "PACKAGE_DIR=packages/clawhub" >> "$GITHUB_ENV"
          elif [[ -d "packages/clawdhub" ]]; then
            echo "PACKAGE_DIR=packages/clawdhub" >> "$GITHUB_ENV"
          else
            echo "Unable to find clawhub CLI package directory." >&2
            exit 1
          fi

      - name: Ensure version is not already published
        run: |
          set -euo pipefail
          PACKAGE_VERSION="$(node --input-type=module <<'EOF'
          import { readFileSync } from "node:fs";

          const pkg = JSON.parse(readFileSync(`./${process.env.PACKAGE_DIR}/package.json`, "utf8"));
          process.stdout.write(String(pkg.version ?? "").trim());
          EOF
          )"

          if npm view "clawhub@${PACKAGE_VERSION}" version >/dev/null 2>&1; then
            echo "clawhub@${PACKAGE_VERSION} is already published on npm."
            exit 1
          fi

          echo "Publishing clawhub@${PACKAGE_VERSION}"

      - name: Verify preflight run metadata
        env:
          GH_TOKEN: ${{ github.token }}
          PREFLIGHT_RUN_ID: ${{ inputs.preflight_run_id }}
        run: |
          set -euo pipefail
          RUN_JSON="$(gh run view "$PREFLIGHT_RUN_ID" --repo "$GITHUB_REPOSITORY" --json workflowName,headBranch,event,conclusion,url)"
          printf '%s' "$RUN_JSON" | node --input-type=module -e 'const chunks=[]; process.stdin.on("data", (chunk) => chunks.push(chunk)); process.stdin.on("end", () => { const run = JSON.parse(Buffer.concat(chunks).toString("utf8")); const checks = [["workflowName", "ClawHub CLI NPM Release"], ["headBranch", "main"], ["event", "workflow_dispatch"], ["conclusion", "success"]]; for (const [key, expected] of checks) { if (run[key] !== expected) { console.error(`Referenced npm preflight run ${process.env.PREFLIGHT_RUN_ID} must have ${key}=${expected}, got ${run[key] ?? "<missing>"}.`); process.exit(1); } } console.log(`Using npm preflight run ${process.env.PREFLIGHT_RUN_ID}: ${run.url}`); });'

      - name: Download prepared npm tarball
        uses: actions/download-artifact@v8
        with:
          name: clawhub-cli-npm-preflight-${{ inputs.tag }}
          path: preflight-tarball
          repository: ${{ github.repository }}
          run-id: ${{ inputs.preflight_run_id }}
          github-token: ${{ github.token }}

      - name: Validate release tag and package metadata
        env:
          RELEASE_TAG: ${{ inputs.tag }}
          RELEASE_MAIN_REF: origin/main
        run: |
          set -euo pipefail
          RELEASE_SHA="$(git rev-parse HEAD)"
          export RELEASE_SHA
          git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
          node scripts/clawhub-cli-npm-release-check.mjs

      - name: Verify prepared tarball provenance
        env:
          RELEASE_TAG: ${{ inputs.tag }}
        run: |
          set -euo pipefail
          EXPECTED_RELEASE_SHA="$(git rev-parse HEAD)"
          EXPECTED_PACKAGE_VERSION="$(node --input-type=module <<'EOF'
          import { readFileSync } from "node:fs";

          const pkg = JSON.parse(readFileSync(`./${process.env.PACKAGE_DIR}/package.json`, "utf8"));
          process.stdout.write(String(pkg.version ?? "").trim());
          EOF
          )"
          TAG_FILE="preflight-tarball/release-tag.txt"
          SHA_FILE="preflight-tarball/release-sha.txt"
          VERSION_FILE="preflight-tarball/package-version.txt"
          if [[ ! -f "$TAG_FILE" || ! -f "$SHA_FILE" || ! -f "$VERSION_FILE" ]]; then
            echo "Prepared preflight metadata is missing." >&2
            ls -la preflight-tarball >&2 || true
            exit 1
          fi
          ARTIFACT_RELEASE_TAG="$(tr -d '\r\n' < "$TAG_FILE")"
          ARTIFACT_RELEASE_SHA="$(tr -d '\r\n' < "$SHA_FILE")"
          ARTIFACT_PACKAGE_VERSION="$(tr -d '\r\n' < "$VERSION_FILE")"
          if [[ "$ARTIFACT_RELEASE_TAG" != "$RELEASE_TAG" ]]; then
            echo "Prepared preflight tag mismatch: expected $RELEASE_TAG, got $ARTIFACT_RELEASE_TAG" >&2
            exit 1
          fi
          if [[ "$ARTIFACT_RELEASE_SHA" != "$EXPECTED_RELEASE_SHA" ]]; then
            echo "Prepared preflight SHA mismatch: expected $EXPECTED_RELEASE_SHA, got $ARTIFACT_RELEASE_SHA" >&2
            exit 1
          fi
          if [[ "$ARTIFACT_PACKAGE_VERSION" != "$EXPECTED_PACKAGE_VERSION" ]]; then
            echo "Prepared preflight package version mismatch: expected $EXPECTED_PACKAGE_VERSION, got $ARTIFACT_PACKAGE_VERSION" >&2
            exit 1
          fi

      - name: Resolve publish tarball
        id: publish_tarball
        run: |
          set -euo pipefail
          TARBALL_PATH="$(find preflight-tarball -type f -name '*.tgz' -print | sort | tail -n 1)"
          if [[ -z "$TARBALL_PATH" ]]; then
            echo "Prepared preflight tarball not found." >&2
            ls -la preflight-tarball >&2 || true
            exit 1
          fi
          echo "path=$TARBALL_PATH" >> "$GITHUB_OUTPUT"

      - name: Publish
        run: |
          set -euo pipefail
          publish_target="${{ steps.publish_tarball.outputs.path }}"
          if [[ -n "${publish_target}" ]]; then
            publish_target="./${publish_target}"
          fi
          bash scripts/clawhub-cli-npm-publish.sh --publish "${publish_target}"