release.yml

name: release

on:
  workflow_call:
    secrets:
      VAULT_URL:
        required: true

jobs:
  release:
    runs-on: ubuntu-latest

    permissions:
      contents: write
      id-token: write
      actions: read

    steps:
      - name: 'Retrieve Secrets from Vault'
        id: vault
        uses: hashicorp/vault-action@v3.4.0
        with:
          url: ${{ secrets.VAULT_URL }}
          role: ${{ github.event.repository.name }}-github-action
          method: jwt
          path: github-actions
          exportEnv: false
          secrets: |
            secret/data/github/github_packages_read GITHUB_PACKAGES_READ_TOKEN | GITHUB_PACKAGES_READ_TOKEN;
            secret/data/github/github_packages_write GITHUB_PACKAGES_WRITE_TOKEN | GITHUB_PACKAGES_WRITE_TOKEN;
            github/token/${{ github.event.repository.name }}-semantic-release token | GITHUB_TOKEN ;

      - name: Get User ID
        id: get-user-id
        run: echo "user-id=$(gh api "/users/contentful-automation[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
        env:
          GITHUB_TOKEN: ${{ steps.vault.outputs.GITHUB_TOKEN }}

      - name: Setting up Git User Credentials
        run: |
          git config --global user.name 'contentful-automation[bot]'
          git config --global user.email '${{ steps.get-user-id.outputs.user-id }}+contentful-automation[bot]@users.noreply.github.com'

      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ steps.vault.outputs.GITHUB_TOKEN }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Restore the build folders
        uses: actions/cache/restore@v5
        with:
          path: |
            build
            packages/mcp-server/dist
            packages/mcp-tools/dist
            contentful-mcp-server.dxt
          key: build-cache-${{ github.run_id }}-${{ github.run_attempt }}

      - uses: nrwl/nx-set-shas@dbe0650947e5f2c81f59190a38512cf49126fe6b # sets NX_BASE, NX_HEAD env vars

      - name: Setup npmrc file
        run: |
          echo "//npm.pkg.github.com/:_authToken=${{ steps.vault.outputs.GITHUB_PACKAGES_WRITE_TOKEN }}" > ~/.npmrc
          echo "@contentful:registry=https://npm.pkg.github.com" >> ~/.npmrc
      - name: NX Release
        run: |
          npx nx release -y
        env:
          GITHUB_TOKEN: ${{ steps.vault.outputs.GITHUB_TOKEN }}

      - name: Get latest release tag
        if: ${{ github.ref_name == 'main' }}
        id: get-tag
        run: |
          TAG=$(gh api repos/${{ github.repository }}/releases/latest --jq .tag_name)
          echo "tag=$TAG" >> $GITHUB_OUTPUT
        env:
          GITHUB_TOKEN: ${{ steps.vault.outputs.GITHUB_TOKEN }}

      - name: Upload DXT file to release
        if: ${{ github.ref_name == 'main' }}
        run: |
          if ! gh release view ${{ steps.get-tag.outputs.tag }} --json assets --jq '.assets[].name' | grep -q "contentful-mcp-server.dxt"; then
            echo "DXT file not found in release, uploading..."
            gh release upload ${{ steps.get-tag.outputs.tag }} \
              ./contentful-mcp-server.dxt
          else
            echo "DXT file already exists in release, skipping upload."
          fi
        env:
          GITHUB_TOKEN: ${{ steps.vault.outputs.GITHUB_TOKEN }}