cut-release.yml

# Cuts a CalVer release and walks it through QA to production.
#
# One run, one audit trail: `deploy-prod` deploys `needs.tag.outputs.tag`, the
# exact tag `deploy-qa` just built, so prod cannot ship something QA never saw.
# The pause before prod is the `production` Environment's required reviewers --
# an environment rule rather than a gate job, so it also covers the other route
# to prod (`promote-to-prod.yml`). A gate job would only guard this workflow.
name: Cut release

on:
  workflow_dispatch: {}

jobs:
  tag:
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    concurrency: release
    permissions:
      contents: write
    outputs:
      tag: ${{ steps.version.outputs.tag }}
    steps:
      - name: Mint App installation token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: ${{ github.event.repository.name }}
          permission-contents: write

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0 # need full tag history to compute the next serial
          token: ${{ steps.app-token.outputs.token }}
          persist-credentials: true

      - name: Compute CalVer tag
        id: version
        run: |
          YEAR_MONTH=$(date +'%y.%m')
          SERIAL=$(git tag -l "v${YEAR_MONTH}.[0-9]*" | sed -E "s/^v${YEAR_MONTH}\.//" | sort -n | tail -1)
          SERIAL=${SERIAL:-0}
          NEXT=$((SERIAL + 1))
          TAG="v${YEAR_MONTH}.${NEXT}"
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
          echo "Computed tag: $TAG"

      - name: Validate CalVer tag format
        env:
          TAG: ${{ steps.version.outputs.tag }}
        run: |
          if [[ ! "$TAG" =~ ^v[0-9]{2}\.(0[1-9]|1[0-2])\.[1-9][0-9]*$ ]]; then
            echo "::error::Tag '$TAG' does not match required CalVer format vYY.MM.SERIAL (e.g. v26.07.1)"
            exit 1
          fi
          echo "Tag '$TAG' is valid."

      - name: Tag and push
        env:
          TAG: ${{ steps.version.outputs.tag }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git tag "$TAG"
          git push origin "$TAG"

      - name: Create GitHub release
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
        with:
          tag_name: ${{ steps.version.outputs.tag }}
          generate_release_notes: true

  deploy-qa:
    needs: tag
    permissions:
      contents: read
    uses: ./.github/workflows/deploy.yml
    secrets: inherit
    with:
      ref: ${{ needs.tag.outputs.tag }}
      environment: qa
      # src/lib/config.ts's enum has no 'qa' member; 'staging' is the QA slot.
      vite_environment: staging
      app_version: ${{ needs.tag.outputs.tag }}

  deploy-prod:
    needs: [tag, deploy-qa]
    permissions:
      contents: read
    uses: ./.github/workflows/deploy.yml
    secrets: inherit
    with:
      ref: ${{ needs.tag.outputs.tag }}
      environment: production
      vite_environment: production
      app_version: ${{ needs.tag.outputs.tag }}