publish.yml

name: Publish Packages

on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      package:
        description: 'Package to publish (e.g. @standardnotes/releases)'
        required: true
        type: string

# Use commit message "[snjs docker only]" to build/push only standardnotes/snjs (:sha + :latest) for E2E; skips full build, web image, and NPM.
# Manual dispatch publishes tagged packages from an existing release commit without bumping versions.

permissions:
  id-token: write

jobs:
  build:
    name: Build & Test
    if: "${{ github.event_name == 'push' && contains(github.event.head_commit.message, 'chore(release): publish') == false && contains(github.event.head_commit.message, '[snjs docker only]') == false }}"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
        with:
          token: ${{ secrets.CI_PAT_TOKEN }}
          fetch-depth: 0
      - name: Set up Node
        uses: actions/setup-node@v3
        with:
          registry-url: 'https://registry.npmjs.org'
          node-version-file: '.nvmrc'
          cache: 'yarn'
      - name: Install dependencies
        run: yarn install --immutable
      - name: Build
        run: yarn build:all
      - name: ESLint
        run: yarn lint
      - name: Build Android
        run: yarn android:bundle
      - name: Test
        run: yarn test

  build-docker:
    name: Build Docker Image
    if: "${{ github.event_name == 'push' && contains(github.event.head_commit.message, 'chore(release): publish') == false }}"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
        with:
          token: ${{ secrets.CI_PAT_TOKEN }}
          fetch-depth: 0
      - name: Set up Node
        uses: actions/setup-node@v3
        with:
          registry-url: 'https://registry.npmjs.org'
          node-version-file: '.nvmrc'
          cache: 'yarn'
      - name: Install dependencies
        run: yarn install --immutable
      - name: Build
        run: yarn build:snjs
      - name: Login to Docker Hub
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Publish SNJS Docker image for E2E testing
        run: |
          yarn docker build @standardnotes/snjs -t standardnotes/snjs:${{ github.sha }}
          docker push standardnotes/snjs:${{ github.sha }}

  e2e-base:
    name: E2E Base Test Suite
    if: false
    needs: build-docker
    runs-on: ubuntu-latest
    steps:
      - name: Run E2E base test suite
        if: "${{ contains(github.event.head_commit.message, 'skip e2e') == false }}"
        uses: convictional/trigger-workflow-and-wait@master
        with:
          owner: standardnotes
          repo: server
          github_token: ${{ secrets.CI_PAT_TOKEN }}
          workflow_file_name: e2e-test-suite.yml
          wait_interval: 30
          client_payload: '{"snjs_image_tag": "${{ github.sha }}", "suite": "base", "author": "${{ github.actor }}", "ref_name": "app:${{ github.ref }}"}'
          propagate_failure: true
          trigger_workflow: true
          wait_workflow: true

  e2e-vaults:
    name: E2E Vaults Test Suite
    if: false
    needs: build-docker
    runs-on: ubuntu-latest
    steps:
      - name: Run E2E vaults test suite
        if: "${{ contains(github.event.head_commit.message, 'skip e2e') == false }}"
        uses: convictional/trigger-workflow-and-wait@master
        with:
          owner: standardnotes
          repo: server
          github_token: ${{ secrets.CI_PAT_TOKEN }}
          workflow_file_name: e2e-test-suite.yml
          wait_interval: 30
          client_payload: '{"snjs_image_tag": "${{ github.sha }}", "suite": "vaults", "author": "${{ github.actor }}", "ref_name": "app:${{ github.ref }}"}'
          propagate_failure: true
          trigger_workflow: true
          wait_workflow: true

  publish-web-docker:
    name: Build and publish Docker Image for Web App
    if: "${{ github.event_name == 'push' && contains(github.event.head_commit.message, 'chore(release): publish') == false && contains(github.event.head_commit.message, '[snjs docker only]') == false }}"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
        with:
          token: ${{ secrets.CI_PAT_TOKEN }}
          fetch-depth: 0

      - name: Set up Node
        uses: actions/setup-node@v3
        with:
          registry-url: 'https://registry.npmjs.org'
          node-version-file: '.nvmrc'
          cache: 'yarn'

      - name: Install dependencies
        run: yarn install --immutable

      - name: Build
        run: yarn build:web

      - name: Login to Docker Hub
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Publish SNJS Docker image for E2E testing
        run: |
          cd packages/web
          docker build -t standardnotes/web:${{ github.sha }} .
          docker tag standardnotes/web:${{ github.sha }} standardnotes/web:latest
          docker push standardnotes/web:${{ github.sha }}
          docker push standardnotes/web:latest

  publish:
    name: Publish to NPM
    if: "${{ github.event_name == 'push' && contains(github.event.head_commit.message, 'chore(release): publish') == false && contains(github.event.head_commit.message, '[snjs docker only]') == false }}"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
        with:
          token: ${{ secrets.CI_PAT_TOKEN }}
          fetch-depth: 0
      - name: Set up Node
        uses: actions/setup-node@v3
        with:
          registry-url: 'https://registry.npmjs.org'
          node-version-file: '.nvmrc'
          cache: 'yarn'
      - name: Upgrade npm (trusted publishing requirement)
        run: npm install -g npm@^11.5.1
      - name: Enable Corepack (Yarn)
        run: corepack enable
      - name: Setup git config
        run: |
          git config --global user.name "standardci"
          git config --global user.email "ci@standardnotes.com"
      - name: Import GPG key
        uses: crazy-max/ghaction-import-gpg@v4
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.PASSPHRASE }}
          git_user_signingkey: true
          git_commit_gpgsign: true
      - name: Install dependencies
        run: yarn install --immutable
      - name: Build
        run: yarn build:all
      - name: Bump version
        run: yarn release:prod
      - name: Publish
        run: yarn publish:prod

  publish-from-git-tags:
    name: Publish to NPM from Git Tags
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
        with:
          token: ${{ secrets.CI_PAT_TOKEN }}
          ref: main
          fetch-depth: 0

      - name: Resolve release commit
        id: release-commit
        run: |
          COMMIT="$(git log main --grep='chore(release): publish' -n 1 --format=%H)"

          if [ -z "$COMMIT" ]; then
            echo "No release commit found on main."
            exit 1
          fi

          if ! git cat-file -e "${COMMIT}^{commit}" 2>/dev/null; then
            echo "Commit ${COMMIT} does not exist."
            exit 1
          fi

          TAG_COUNT="$(git tag --points-at "$COMMIT" | wc -l | tr -d ' ')"
          if [ "$TAG_COUNT" -eq 0 ]; then
            echo "Commit ${COMMIT} has no release tags."
            exit 1
          fi

          echo "commit=${COMMIT}" >> "$GITHUB_OUTPUT"
          echo "Using release commit ${COMMIT}"
          git tag --points-at "$COMMIT"

      - name: Checkout release commit
        run: git checkout "${{ steps.release-commit.outputs.commit }}"

      - name: Set up Node
        uses: actions/setup-node@v3
        with:
          registry-url: 'https://registry.npmjs.org'
          node-version-file: '.nvmrc'
          cache: 'yarn'

      - name: Upgrade npm (trusted publishing requirement)
        run: npm install -g npm@^11.5.1

      - name: Enable Corepack (Yarn)
        run: corepack enable

      - name: Install dependencies
        run: yarn install --immutable

      - name: Build
        run: yarn build:all

      - name: Publish tagged package
        env:
          PACKAGE: ${{ inputs.package }}
        run: |
          set -euo pipefail

          PACKAGE="$(echo "$PACKAGE" | xargs)"
          if [ -z "$PACKAGE" ]; then
            echo "Package name is required."
            exit 1
          fi

          mapfile -t TAGS < <(git tag --points-at HEAD --list "${PACKAGE}@*")
          if [ "${#TAGS[@]}" -eq 0 ]; then
            echo "No release tag found for ${PACKAGE} at the release commit."
            exit 1
          fi

          if [ "${#TAGS[@]}" -gt 1 ]; then
            echo "Multiple release tags found for ${PACKAGE}: ${TAGS[*]}"
            exit 1
          fi

          echo "Publishing ${PACKAGE} (${TAGS[0]})..."
          yarn workspace "$PACKAGE" npm publish --access public

  publish-docker:
    name: Publish to Docker Hub
    needs: build-docker
    if: "${{ github.event_name == 'push' && contains(github.event.head_commit.message, 'chore(release): publish') == false }}"
    runs-on: ubuntu-latest
    steps:
      - name: Login to Docker Hub
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: Publish SNJS Docker image as stable
        run: |
          docker pull standardnotes/snjs:${{ github.sha }}
          docker tag standardnotes/snjs:${{ github.sha }} standardnotes/snjs:latest
          docker push standardnotes/snjs:latest