action.yml

name: OpenShock Release Tool
description: Reads .changes/ files, bumps semver, writes release.json, tags the commit.
branding:
  icon: package
  color: blue

inputs:
  mode:
    description: >
      'release' reads .changes/config.json branch config to determine behavior (stable, prerelease, or no-tag),
      'status' validates pending changes and prints the next version without creating a tag,
      'check' validates the change files a pull request adds and writes release-check.json.
    required: true
    options:
      - release
      - status
      - check
  dry-run:
    description: Preview without making changes (prints JSON to stdout, no tag created)
    required: false
    default: 'false'
  output:
    description: Path to write release.json (relative to the consuming repo root)
    required: false
    default: release.json
  notes-output:
    description: Path to write markdown release notes (relative to the consuming repo root)
    required: false
    default: ''
  version:
    description: >
      release mode, stable branches only: release this MAJOR.MINOR.PATCH instead
      of the computed version. It may skip ahead (e.g. past a tag GitHub no
      longer accepts) but not below what the pending changes require.
    required: false
    default: ''
  base-ref:
    description: "check mode: PR base branch name (resolved via config.json branches)"
    required: false
    default: ${{ github.event.pull_request.base.ref }}
  base-sha:
    description: "check mode: base commit to diff against for added change files"
    required: false
    default: ${{ github.event.pull_request.base.sha }}
  pr-number:
    description: "check mode: pull request number, recorded in the verdict"
    required: false
    default: ${{ github.event.pull_request.number }}
  require-changes:
    description: >
      check mode: fail when the pull request adds no change file. Skip the check
      for intentional non-release changes with the no-changelog label, or list
      such paths under ignore_paths in .changes/config.json.
    required: false
    default: 'true'
  go-version:
    description: Go version to use
    required: false
    default: '1.25'

outputs:
  tag:
    description: The tag that was created (empty when no tag was created)
    value: ${{ steps.run.outputs.tag }}
  version:
    description: >
      release/prerelease mode: the full computed version string (the tag without
      prefix), set even on the no-tag path where 'tag' is empty.
    value: ${{ steps.run.outputs.version }}
  next-version:
    description: >
      status mode: the next base version (MAJOR.MINOR.PATCH, no prerelease label).
      Computed on any branch since status has no branch-config dependency.
    value: ${{ steps.run.outputs.next-version }}
  previous-version:
    description: The prior stable base version (empty if there is no prior tag)
    value: ${{ steps.run.outputs.previous-version }}
  bump:
    description: "status mode: the computed bump level (patch, minor, major)"
    value: ${{ steps.run.outputs.bump }}
  prerelease:
    description: Whether the created tag is a prerelease
    value: ${{ steps.run.outputs.prerelease }}
  skip:
    description: true when there were no pending changes
    value: ${{ steps.run.outputs.skip }}

runs:
  using: composite
  steps:
    # Cache the compiled binary instead of recompiling via `go run .` on every
    # invocation. The key is a content hash of the Go sources, so it is correct
    # both for external consumers (pinned by SHA, source under _actions/) and for
    # this repo's own `uses: ./` self-invocation (source changes per commit).
    # setup-go's own module cache can't help here: its cache-dependency-path is
    # the action's go.sum under _actions/, outside GITHUB_WORKSPACE, which the
    # cache key resolver rejects ("Some specified paths were not resolved").
    - name: Hash release-tool sources
      id: srchash
      shell: bash
      working-directory: ${{ github.action_path }}
      run: |
        h=$(find . -type f \( -name '*.go' -o -name 'go.mod' -o -name 'go.sum' \) \
          -print0 | sort -z | xargs -0 sha256sum | sha256sum | awk '{print $1}')
        echo "hash=$h" >> "$GITHUB_OUTPUT"
        # Emit a normalized absolute path: github.action_path ends in "/." for
        # `uses: ./`, and actions/cache rejects any path containing "/./".
        echo "binpath=$(pwd -P)/release-tool" >> "$GITHUB_OUTPUT"

    - name: Restore release-tool binary
      id: cache-bin
      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
      with:
        path: ${{ steps.srchash.outputs.binpath }}
        key: release-tool-${{ runner.os }}-${{ runner.arch }}-go${{ inputs.go-version }}-${{ steps.srchash.outputs.hash }}

    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
      if: steps.cache-bin.outputs.cache-hit != 'true'
      with:
        go-version: ${{ inputs.go-version }}
        cache: false

    - name: Build release-tool
      if: steps.cache-bin.outputs.cache-hit != 'true'
      shell: bash
      working-directory: ${{ github.action_path }}
      run: go build -o release-tool .

    - name: Configure git identity
      shell: bash
      run: |
        git config user.name  "github-actions[bot]"
        git config user.email "github-actions[bot]@users.noreply.github.com"

    # release mode tags the current commit, so it must be tagging the true
    # tip (not one about to be superseded by a racing push), and previous/
    # next version computation needs full tag history to be correct.
    - name: Rebase on top of latest remote
      if: inputs.mode == 'release'
      shell: bash
      run: git pull --rebase --autostash origin "${GITHUB_REF_NAME}"

    - name: Fetch all tags
      if: inputs.mode == 'release'
      shell: bash
      run: git fetch --tags

    - name: Run release tool
      id: run
      shell: bash
      working-directory: ${{ github.action_path }}
      env:
        DRY_RUN: ${{ inputs.dry-run }}
        RELEASE_MODE: ${{ inputs.mode }}
        RELEASE_OUTPUT: ${{ inputs.output }}
        RELEASE_NOTES: ${{ inputs.notes-output }}
        RELEASE_VERSION: ${{ inputs.version }}
        WORKSPACE: ${{ github.workspace }}
        BASE_REF: ${{ inputs.base-ref }}
        BASE_SHA: ${{ inputs.base-sha }}
        PR_NUMBER: ${{ inputs.pr-number }}
        REQUIRE_CHANGES: ${{ inputs.require-changes }}
      run: |
        BIN="$PWD/release-tool"
        case "$RELEASE_MODE" in
          release)
            ARGS=(--root "$WORKSPACE" --output "$WORKSPACE/$RELEASE_OUTPUT")
            [ -n "$RELEASE_NOTES" ] && ARGS+=(--notes "$WORKSPACE/$RELEASE_NOTES")
            [ -n "$RELEASE_VERSION" ] && ARGS+=(--version "$RELEASE_VERSION")
            [ "$DRY_RUN" = "true" ] && ARGS+=(--dry-run)
            "$BIN" release "${ARGS[@]}"
            ;;
          status)
            "$BIN" status --root "$WORKSPACE"
            ;;
          check)
            ARGS=(--root "$WORKSPACE" --base "$BASE_REF" --against "$BASE_SHA" \
              --pr "$PR_NUMBER" --out "$WORKSPACE/release-check.json")
            [ "$REQUIRE_CHANGES" = "true" ] && ARGS+=(--require-changes)
            "$BIN" check "${ARGS[@]}"
            ;;
          *)
            echo "Unknown mode: $RELEASE_MODE" >&2
            exit 1
            ;;
        esac