ci.yml

name: CI

# Release topology: GitLab (origin, branch `master`) is primary; this repo is a GitHub MIRROR
# whose default branch is `main`. Each GitLab push mirrors a squashed snapshot to `main`, which
# triggers this workflow (lint/typecheck/test/build → CalVer npm publish). The `main` triggers
# below are CORRECT for the mirror — do NOT repoint them to `master`. See docs/project/runbook.md.
#
# Checks run for package code and their test/policy inputs. A separate job decides whether a
# push is publishable, so test-only and workflow-only changes cannot bump the npm CalVer version.
on:
  workflow_dispatch:
  push:
    branches: [main]
    paths:
      - "src/**"
      - "examples/**"
      - "assets/**"
      - "package.json"
      - "package-lock.json"
      - "tsconfig.json"
      - "tests/unit/**"
      - "docs/**"
      - "*.md"
      - ".agents/**/*.md"
      - ".claude/commands/**/*.md"
      - "scripts/check-terminal-io.mjs"
      - "scripts/check-markdown-links.mjs"
      - "scripts/clean-build.mjs"
      - "vitest.config.ts"
      - "eslint.config.ts"
      - ".prettierrc"
      - "knip.json"
      - ".dependency-cruiser.cjs"
      - ".github/workflows/ci.yml"
  pull_request:
    branches: [main]
    paths:
      - "src/**"
      - "examples/**"
      - "assets/**"
      - "package.json"
      - "package-lock.json"
      - "tsconfig.json"
      - "tests/unit/**"
      - "docs/**"
      - "*.md"
      - ".agents/**/*.md"
      - ".claude/commands/**/*.md"
      - "scripts/check-terminal-io.mjs"
      - "scripts/check-markdown-links.mjs"
      - "scripts/clean-build.mjs"
      - "vitest.config.ts"
      - "eslint.config.ts"
      - ".prettierrc"
      - "knip.json"
      - ".dependency-cruiser.cjs"
      - ".github/workflows/ci.yml"

permissions:
  contents: read

jobs:
  package-changes:
    name: Detect package changes
    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    outputs:
      publish: ${{ steps.filter.outputs.publish }}
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Check publishable paths
        id: filter
        shell: bash
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "publish=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          BEFORE="${{ github.event.before }}"
          if git cat-file -e "${BEFORE}^{commit}" 2>/dev/null && \
             git diff --quiet "$BEFORE" "$GITHUB_SHA" -- \
               src examples assets package.json package-lock.json tsconfig.json scripts/clean-build.mjs; then
            echo "publish=false" >> "$GITHUB_OUTPUT"
          else
            echo "publish=true" >> "$GITHUB_OUTPUT"
          fi

  check:
    name: Lint & Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: npm

      - run: npm ci

      - name: Static checks
        run: npm run lint:all

      - name: Unit tests
        run: npm run test:unit

      - name: Build
        run: npm run build

  publish:
    name: Publish to npm
    needs: [check, package-changes]
    if: needs.package-changes.outputs.publish == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v6
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org
          package-manager-cache: false

      - run: npm ci

      - run: npm run build

      - name: Set CalVer version from commit date
        id: version
        run: |
          VERSION=$(git log -1 --format=%cd --date=format:%y.%-m%d.%H%M)
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          npm version --no-git-tag-version "$VERSION" --allow-same-version

      - name: Check if version exists on npm
        id: check-npm
        run: |
          if npm view prompsit-cli@${{ steps.version.outputs.version }} version 2>/dev/null; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Publish
        id: publish
        if: steps.check-npm.outputs.exists == 'false'
        run: npm publish --access public

      - name: Extract release notes from CHANGELOG
        if: steps.publish.outcome == 'success'
        id: notes
        run: |
          sed -n '/^## Unreleased$/,/^## /{/^## /d;p}' CHANGELOG.md > /tmp/release-notes.md
          if [ ! -s /tmp/release-notes.md ]; then
            echo "skip=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Create GitHub Release
        if: steps.publish.outcome == 'success' && steps.notes.outputs.skip != 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create "v${{ steps.version.outputs.version }}" \
            --title "v${{ steps.version.outputs.version }}" \
            --notes-file /tmp/release-notes.md \
            --latest

      - name: Delete older GitHub Releases
        if: steps.publish.outcome == 'success' && steps.notes.outputs.skip != 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          CURRENT="v${{ steps.version.outputs.version }}"
          gh release list --limit 200 --json tagName --jq '.[].tagName' | while IFS= read -r tag; do
            if [ -n "$tag" ] && [ "$tag" != "$CURRENT" ]; then
              echo "Deleting old release: $tag"
              gh release delete "$tag" --yes --cleanup-tag
            fi
          done