action.yml

name: 'Craft Prepare Release'
description: 'Prepare a new release using Craft'

inputs:
  version:
    description: >
      Version to release. Can be a semver string (e.g., "1.2.3"),
      a bump type ("major", "minor", "patch"), "auto" for automatic detection,
      or "pre" for the next prerelease.
    required: false
  merge_target:
    description: Target branch to merge into. Uses the default branch as a fallback.
    required: false
  force:
    description: Force a release even when there are release-blockers
    required: false
    default: 'false'
  blocker_label:
    description: Label that blocks releases
    required: false
    default: 'release-blocker'
  publish_repo:
    description: Repository for publish issues (owner/repo format)
    required: false
  git_user_name:
    description: Git committer name
    required: false
  git_user_email:
    description: Git committer email
    required: false
  path:
    description: The path that Craft will run inside
    required: false
    default: '.'
  workspace:
    description: Named Craft release workspace to prepare and publish
    required: false
  craft_config_from_merge_target:
    description: Use the craft config from the merge target branch
    required: false
    default: 'false'
  craft_version:
    description: >
      Version of Craft to install (release tag, "latest", "nightly", or
      "nightly-<full commit SHA>").
      Defaults to the action ref; major refs such as "v2" use the action's
      package.json, while SHA refs select the matching published release or
      their own development nightly.
    required: false
    default: ''

  llm:
    description: >
      JSON object with AI summary endpoint, model, and apiKeyEnv.
      Overrides CRAFT_AI_LLM and .craft.yml connection settings.
      Omitted fields use Copilot Responses, gpt-5.4-nano, and GITHUB_TOKEN.
    required: false
  llm_api_key:
    description: >
      AI summary credential (map a secret or an authorized GitHub token here).
      Alternatively provide the credential in the configured environment variable.
    required: false

outputs:
  version:
    description: The resolved version being released
    value: ${{ steps.craft.outputs.version }}
  branch:
    description: The release branch name
    value: ${{ steps.craft.outputs.branch }}
  sha:
    description: The commit SHA on the release branch
    value: ${{ steps.craft.outputs.sha }}
  previous_tag:
    description: The tag before this release (for diff links)
    value: ${{ steps.craft.outputs.previous_tag }}
  changelog:
    description: The changelog for this release (may be truncated for large repos)
    value: ${{ steps.craft.outputs.changelog }}
  changelog_file:
    description: Path to the full changelog file (available when running in GitHub Actions)
    value: ${{ steps.craft.outputs.changelog_file }}
  issue_url:
    description: The URL of the created publish request issue
    value: ${{ steps.request-publish.outputs.issue_url }}

runs:
  using: 'composite'
  steps:
    - name: Validate workspace
      shell: bash
      env:
        LC_ALL: C
        PATH_INPUT: ${{ inputs.path }}
        WORKSPACE: ${{ inputs.workspace }}
      run: |
        if [[ -n "$WORKSPACE" && "$PATH_INPUT" != '.' ]]; then
          echo "::error::The path and workspace inputs cannot be used together."
          exit 1
        fi
        if ! node -e 'const path = process.env.PATH_INPUT; const segment = /^[A-Za-z0-9_.-]+$/; process.exit(path === "." || (typeof path === "string" && path.split("/").every(name => segment.test(name) && ![".", "..", "__proto__"].includes(name) && !name.startsWith("-"))) ? 0 : 1)'; then
          echo "::error::The path input must use ASCII path segments containing only letters, digits, periods, underscores, and hyphens."
          exit 1
        fi
        if [[ -n "$WORKSPACE" ]] && ! node -e 'const workspace = process.env.WORKSPACE; const segment = /^[A-Za-z0-9_.-]+$/; process.exit(workspace.split("/").every(name => segment.test(name) && ![".", "..", "__proto__"].includes(name) && !name.startsWith("-")) ? 0 : 1)'; then
          echo "::error::Workspace names must use ASCII path segments containing only letters, digits, periods, underscores, and hyphens."
          exit 1
        fi

    - id: killswitch
      name: Check release blockers
      shell: bash
      env:
        FORCE_INPUT: ${{ inputs.force }}
        BLOCKER_LABEL_INPUT: ${{ inputs.blocker_label }}
      run: |
        if [[ "$FORCE_INPUT" == 'true' ]]; then
          exit 0
        fi
        # Fail closed: if the lookup fails, `set -e` stops the release.
        blocker_count=$(gh issue list -R "$GITHUB_REPOSITORY" -l "$BLOCKER_LABEL_INPUT" -s open --json number --jq length)
        if [[ "$blocker_count" != '0' ]]; then
          echo "::error::Open release-blocking issues found (label: $BLOCKER_LABEL_INPUT), cancelling release..."
          # Run cancellation is asynchronous and does not stop the remaining
          # steps of this composite action in time, so fail the step as well.
          gh api -X POST "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/cancel" || true
          exit 1
        fi

    - name: Set git user
      shell: bash
      env:
        GIT_USER_NAME: ${{ inputs.git_user_name || github.actor }}
        GIT_USER_EMAIL: ${{ inputs.git_user_email || format('{0}+{1}@users.noreply.github.com', github.actor_id, github.actor) }}
      run: |
        echo "GIT_COMMITTER_NAME=${GIT_USER_NAME}" >> $GITHUB_ENV
        echo "GIT_AUTHOR_NAME=${GIT_USER_NAME}" >> $GITHUB_ENV
        echo "EMAIL=${GIT_USER_EMAIL}" >> $GITHUB_ENV

    # === Install Craft ===
    # For dogfooding (getsentry/craft): try build artifact from build job
    # For all repos (or if artifact unavailable): download from release or GHCR

    - name: Download Craft from build artifact
      id: craft-artifact
      if: github.repository == 'getsentry/craft' && inputs.craft_version == ''
      continue-on-error: true
      uses: actions/download-artifact@v8
      with:
        name: craft-binary
        path: /tmp/craft-artifact

    - name: Download native Craft from build artifact
      if: github.repository == 'getsentry/craft' && inputs.craft_version == ''
      continue-on-error: true
      uses: actions/download-artifact@v8
      with:
        name: craft-native
        path: ${{ runner.temp }}/craft-native-artifact

    - name: Install Craft from artifact or release
      shell: bash
      env:
        CRAFT_VERSION_INPUT: ${{ inputs.craft_version }}
        ACTION_REF: ${{ github.action_ref }}
        ACTION_PATH: ${{ github.action_path }}
        CRAFT_USE_ARTIFACTS: ${{ github.repository == 'getsentry/craft' && inputs.craft_version == '' }}
      run: |
        set -euo pipefail
        CRAFT_VERSION="$(bash "$ACTION_PATH/.github/scripts/resolve-craft-version.sh" "$CRAFT_VERSION_INPUT" "$ACTION_REF" "$ACTION_PATH")"
        unset CRAFT_NATIVE_ARTIFACT_DIRECTORY CRAFT_LEGACY_ARTIFACT CRAFT_ARTIFACT_VERSION
        if [[ "$CRAFT_USE_ARTIFACTS" == 'true' ]]; then
          export CRAFT_NATIVE_ARTIFACT_DIRECTORY="$RUNNER_TEMP/craft-native-artifact"
          export CRAFT_LEGACY_ARTIFACT=/tmp/craft-artifact/dist/craft
          export CRAFT_ARTIFACT_VERSION="$(node -p 'require(process.env.ACTION_PATH + "/package.json").version')"
        fi
        CRAFT_DRY_RUN= DRY_RUN= bash "$ACTION_PATH/install" --version "$CRAFT_VERSION" --install-dir "$RUNNER_TEMP/craft-bin"

    - name: Craft Prepare
      id: craft
      shell: bash
      env:
        CRAFT_LOG_LEVEL: Debug
        CRAFT_AI_LLM: ${{ inputs.llm || env.CRAFT_AI_LLM }}
        LLM_API_KEY_INPUT_SET: ${{ inputs.llm_api_key != '' }}
        AI_SUMMARY_TOKEN: ${{ inputs.llm_api_key || env.AI_SUMMARY_TOKEN }}
        CRAFT_CONFIG_FROM_MERGE_TARGET: ${{ inputs.craft_config_from_merge_target }}
        MERGE_TARGET: ${{ inputs.merge_target }}
        VERSION: ${{ inputs.version }}
        WORKSPACE: ${{ inputs.workspace }}
      working-directory: ${{ inputs.path }}
      run: |
        unset CRAFT_WORKSPACE
        # Ensure we have origin/HEAD set
        git remote set-head origin --auto

        # Build command with optional flags
        CRAFT_ARGS=()
        if [[ "$CRAFT_CONFIG_FROM_MERGE_TARGET" == 'true' && -n "$MERGE_TARGET" ]]; then
          CRAFT_ARGS=(--config-from "$MERGE_TARGET")
        fi
        if [[ -n "$WORKSPACE" ]]; then
          CRAFT_ARGS+=("--workspace=$WORKSPACE")
        fi

        if [[ "$LLM_API_KEY_INPUT_SET" == 'true' ]]; then
          CRAFT_ARGS+=(--ai-api-key-env AI_SUMMARY_TOKEN)
        fi

        # Version is optional - if not provided, Craft uses versioning.policy from config
        VERSION_ARG=()
        if [[ -n "$VERSION" ]]; then
          VERSION_ARG=("$VERSION")
        fi

        craft prepare "${VERSION_ARG[@]}" "${CRAFT_ARGS[@]}"

    - name: Read Craft Targets
      id: craft-targets
      shell: bash
      working-directory: ${{ inputs.path }}
      env:
        CRAFT_LOG_LEVEL: Warn
        PREPARED_TARGETS: ${{ steps.craft.outputs.targets }}
        WORKSPACE: ${{ inputs.workspace }}
      run: |
        unset CRAFT_WORKSPACE
        # `craft prepare` lists the targets from the release branch before it
        # switches back to the default branch. Craft versions that don't emit
        # them fall back to listing the targets of the current checkout.
        if [[ -n "$PREPARED_TARGETS" ]]; then
          targets_json="$PREPARED_TARGETS"
        else
          CRAFT_ARGS=()
          if [[ -n "$WORKSPACE" ]]; then
            CRAFT_ARGS=("--workspace=$WORKSPACE")
          fi
          targets_json=$(craft targets "${CRAFT_ARGS[@]}")
        fi
        targets=$(jq -r '.[]|" - [ ] \(.)"' <<< "$targets_json")

        # https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#multiline-strings
        echo "targets<<EOF" >> "$GITHUB_OUTPUT"
        echo "$targets" >> "$GITHUB_OUTPUT"
        echo "EOF" >> "$GITHUB_OUTPUT"

    - name: Request publish
      id: request-publish
      shell: bash
      env:
        # NOTE: CHANGELOG is read from a file to avoid E2BIG errors.
        # Large changelogs (e.g. sentry's monthly releases) can exceed the ~2 MB
        # Linux ARG_MAX limit when passed as an environment variable.
        CHANGELOG_FILE: ${{ steps.craft.outputs.changelog_file }}
        TARGETS: ${{ steps.craft-targets.outputs.targets }}
        RESOLVED_VERSION: ${{ steps.craft.outputs.version }}
        RELEASE_BRANCH: ${{ steps.craft.outputs.branch }}
        RELEASE_SHA: ${{ steps.craft.outputs.sha }}
        RELEASE_PREVIOUS_TAG: ${{ steps.craft.outputs.previous_tag || 'HEAD' }}
        SUBDIRECTORY: ${{ inputs.path != '.' && format('/{0}', inputs.path) || '' }}
        MERGE_TARGET: ${{ inputs.merge_target || '(default)' }}
        PUBLISH_REPO: ${{ inputs.publish_repo || format('{0}/publish', github.repository_owner) }}
        WORKSPACE: ${{ inputs.workspace }}
      run: |
        # Resolve "self" to the current repository
        if [[ "$PUBLISH_REPO" == "self" ]]; then
          PUBLISH_REPO="$GITHUB_REPOSITORY"
        fi

        if [[ -z "$RESOLVED_VERSION" ]]; then
          echo "::error::Craft did not output a version. This is unexpected."
          exit 1
        fi
        # Read changelog from file to avoid E2BIG.
        # Produced by craft >= 2.22.0; older versions don't produce the file
        # and the publish issue will be created without a changelog section.
        CHANGELOG=""
        if [[ -n "${CHANGELOG_FILE:-}" && -f "$CHANGELOG_FILE" ]]; then
          CHANGELOG=$(cat "$CHANGELOG_FILE")
        fi

        # GitHub issue bodies are limited to ~65 536 characters.  Truncate
        # the changelog to stay under that limit with room for the rest of
        # the body template (~2 KB of surrounding markdown).
        MAX_CHANGELOG_CHARS=60000
        if [[ ${#CHANGELOG} -gt $MAX_CHANGELOG_CHARS ]]; then
          CHANGELOG="${CHANGELOG:0:$MAX_CHANGELOG_CHARS}"$'\n\n---\n*Changelog truncated for issue body.*'
        fi

        title="publish: ${GITHUB_REPOSITORY}${SUBDIRECTORY}${WORKSPACE:+/$WORKSPACE}@${RESOLVED_VERSION}"

        # Check if issue already exists by listing all open issues and filtering by exact title match.
        # We avoid GitHub search API to bypass indexing delays and query syntax edge cases.
        # gh issue list returns issues sorted by creation date (most recent first), so we take
        # the first match to handle the theoretical case of duplicate titles.
        existing_issue=$(gh -R "$PUBLISH_REPO" issue list --json title,url,number,body | jq -r --arg t "$title" '[.[] | select(.title == $t)] | first // empty')
        existing_issue_url=""
        existing_issue_number=""
        existing_body=""
        if [[ -n "$existing_issue" ]]; then
          existing_issue_url=$(echo "$existing_issue" | jq -r '.url')
          existing_issue_number=$(echo "$existing_issue" | jq -r '.number')
          existing_body=$(echo "$existing_issue" | jq -r '.body')
        fi

        # Extract checked targets from the existing body.
        # Targets appear as " - [x] targetName" or " - [X] targetName" in markdown.
        # We only look within the "### Targets" section to avoid matching checkboxes in the changelog.
        # We store them in an associative array for O(1) lookup when rebuilding targets.
        declare -A checked_targets
        if [[ -n "$existing_body" ]]; then
          # Extract only the Targets section (between "### Targets" and "Checked targets will be skipped")
          targets_section=$(echo "$existing_body" | sed -n '/### Targets/,/Checked targets will be skipped/p')
          while IFS= read -r target; do
            [[ -n "$target" ]] && checked_targets["$target"]=1
          done < <(echo "$targets_section" | grep -oE '^\s*-\s*\[[xX]\]\s+\S+' | sed 's/.*\[[xX]\][[:space:]]*//')
        fi

        # Apply preserved checked states to the new targets list.
        # For each target in the new list, check if it was marked as checked in the original.
        if [[ ${#checked_targets[@]} -gt 0 ]]; then
          new_targets=""
          while IFS= read -r line; do
            # Extract target name from " - [ ] targetName" format
            target_name=$(echo "$line" | sed 's/.*\[ \][[:space:]]*//')
            if [[ -n "$target_name" && -n "${checked_targets[$target_name]+x}" ]]; then
              # This target was checked in the original, preserve that state
              line=$(echo "$line" | sed 's/\[ \]/[x]/')
            fi
            new_targets+="${line}"$'\n'
          done <<< "$TARGETS"
          # Remove trailing newline
          TARGETS="${new_targets%$'\n'}"
        fi

        # Build changelog section if available
        if [[ -n "$CHANGELOG" ]]; then
          CHANGELOG_SECTION="
        ---

        <details open>
        <summary>📋 Changelog</summary>

        ${CHANGELOG}

        </details>"
        else
          CHANGELOG_SECTION=""
        fi

        body="Requested by: @${GITHUB_ACTOR}

        Merge target: ${MERGE_TARGET}

        Quick links:
        - [View changes](https://github.com/${GITHUB_REPOSITORY}/compare/${RELEASE_PREVIOUS_TAG}...${RELEASE_BRANCH})
        - [View check runs](https://github.com/${GITHUB_REPOSITORY}/commit/${RELEASE_SHA}/checks/)

        Assign the **accepted** label to this issue to approve the release.

        ### Targets

        ${TARGETS}

        Checked targets will be skipped (either already published or user-requested skip). Uncheck to retry a target.
        ${CHANGELOG_SECTION}"

        if [[ -n "$existing_issue_number" ]]; then
          # Try to update existing issue with fresh body (preserving checked target states)
          # This may fail if the token doesn't have permission to update issues in the publish repo
          if gh issue edit "$existing_issue_number" -R "$PUBLISH_REPO" --body "$body" 2>/dev/null; then
            echo "::notice::Updated existing publish request: ${existing_issue_url}"
          else
            echo "::warning::Could not update existing issue (permission denied). Using existing issue as-is."
          fi
          echo "issue_url=${existing_issue_url}" >> "$GITHUB_OUTPUT"
        else
          # Create new issue
          issue_url=$(gh issue create -R "$PUBLISH_REPO" --title "$title" --body "$body")
          echo "::notice::Created publish request: ${issue_url}"
          echo "issue_url=${issue_url}" >> "$GITHUB_OUTPUT"
        fi