changesets_release.yml

name: Changesets

on:
  push:
    branches:
      - main

concurrency: ${{ github.workflow }}-${{ github.ref }}

permissions:
  id-token: write # Required for OIDC
  contents: write # Required to push tags and create releases
  pull-requests: write # Required for changesets to create PRs
  issues: write # Required for changesets to comment on issues about the release in which they were fixed

jobs:
  changesets:
    name: Make a PR or publish
    runs-on: ubuntu-latest
    outputs:
      published: ${{ steps.changesets.outputs.published }}
      sync_service_release_tag: ${{ steps.sync_service_release_tag.outputs.tag }}
      agent_server_release_tag: ${{ steps.agent_server_release_tag.outputs.tag }}
      desktop_release_version: ${{ steps.desktop_release.outputs.version }}
      desktop_release_tag: ${{ steps.desktop_release.outputs.tag }}
      mobile_release_version: ${{ steps.mobile_release.outputs.version }}
      mobile_release_tag: ${{ steps.mobile_release.outputs.tag }}
      server_rust_needs_release: ${{ steps.server_rust_release.outputs.needs_release }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version-file: '.tool-versions'
      - uses: erlef/setup-beam@v1
        with:
          version-type: strict
          version-file: '.tool-versions'
      - run: pnpm install --frozen-lockfile
      - run: pnpm run -r --filter './packages/**' build

      - name: Create Release Pull Request or Publish
        id: changesets
        uses: changesets/action@v1
        with:
          version: pnpm ci:version
          publish: pnpm ci:publish
          title: 'chore: publish new package versions'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HEX_API_KEY: ${{ secrets.HEX_API_KEY }}
      - name: Capture the new sync-service release as an output (if any)
        id: sync_service_release_tag
        if: steps.changesets.outputs.published == 'true'
        run: |
          # Assign publishedPackages to a variable first to avoid any interpretation of JSON special chars by the shell
          PUBLISHED_PACKAGES='${{ steps.changesets.outputs.publishedPackages }}'
          # Use jq to pick the relevant package from the JSON array and format it into a <package>@<version> output
          TAGS=$(echo "$PUBLISHED_PACKAGES" | jq -r '.[] | select(.name == "@core/sync-service") | .name + "@" + .version')
          echo "tag=$TAGS" >> "$GITHUB_OUTPUT"
      - name: Capture the new agents-server release as an output (if any)
        id: agent_server_release_tag
        if: steps.changesets.outputs.published == 'true'
        run: |
          PUBLISHED_PACKAGES='${{ steps.changesets.outputs.publishedPackages }}'
          TAGS=$(echo "$PUBLISHED_PACKAGES" | jq -r '.[] | select(.name == "@electric-ax/agents-server") | .name + "@" + .version')
          echo "tag=$TAGS" >> "$GITHUB_OUTPUT"
      - name: Capture the new agents-desktop release as an output (if any)
        id: desktop_release
        if: steps.changesets.outputs.published == 'true'
        run: |
          PUBLISHED_PACKAGES='${{ steps.changesets.outputs.publishedPackages }}'
          VERSION=$(echo "$PUBLISHED_PACKAGES" | jq -r '.[] | select(.name == "@electric-ax/agents-desktop") | .version' | head -n 1)
          if [ -n "$VERSION" ]; then
            echo "version=$VERSION" >> "$GITHUB_OUTPUT"
            echo "tag=@electric-ax/agents-desktop@$VERSION" >> "$GITHUB_OUTPUT"
          fi
      - name: Capture the new agents-mobile release as an output (if any)
        id: mobile_release
        if: steps.changesets.outputs.published == 'true'
        run: |
          PUBLISHED_PACKAGES='${{ steps.changesets.outputs.publishedPackages }}'
          VERSION=$(echo "$PUBLISHED_PACKAGES" | jq -r '.[] | select(.name == "@electric-ax/agents-mobile") | .version' | head -n 1)
          if [ -n "$VERSION" ]; then
            echo "version=$VERSION" >> "$GITHUB_OUTPUT"
            echo "tag=@electric-ax/agents-mobile@$VERSION" >> "$GITHUB_OUTPUT"
          fi
      - name: Detect a server-rust release (private anchor → idempotent crates.io check)
        id: server_rust_release
        if: steps.changesets.outputs.published == 'true'
        run: |
          # @electric-ax/durable-streams-server-rust is `private: true` (changesets
          # bumps it but never publishes it), so it is not in publishedPackages.
          # The npm packages are disabled, so the crate is what actually publishes —
          # check crates.io (the published artifact) for idempotency. Publish only if
          # this version is not already on crates.io: idempotent across re-runs (and
          # across unrelated releases that leave the server-rust version unchanged),
          # and correct on the first run. The crate version is synced to this anchor
          # at publish time by sync-cargo-version.mjs.
          VERSION="$(node -p "require('./packages/durable-streams-rust/package.json').version")"
          if curl -sf -H 'User-Agent: electric-sql-release-ci' "https://crates.io/api/v1/crates/durable-streams/$VERSION" >/dev/null 2>&1; then
            echo "needs_release=false" >> "$GITHUB_OUTPUT"
          else
            echo "needs_release=true" >> "$GITHUB_OUTPUT"
          fi
      - name: Add latest tag to published packages
        if: steps.changesets.outputs.published == 'true'
        run: node scripts/tag-latest.mjs
      - name: Comment on PRs about release
        if: steps.changesets.outputs.published == 'true'
        run: node scripts/comment-on-release.mjs
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PUBLISHED_PACKAGES: ${{ steps.changesets.outputs.publishedPackages }}

  publish-to-dockerhub:
    needs: changesets
    if: ${{ needs.changesets.outputs.published == 'true' && needs.changesets.outputs.sync_service_release_tag  != '' }}
    uses: ./.github/workflows/sync_service_dockerhub_image.yml
    secrets: inherit
    with:
      git_ref: ${{ needs.changesets.outputs.sync_service_release_tag }}

  publish-agent-server-to-dockerhub:
    needs: changesets
    if: ${{ needs.changesets.outputs.published == 'true' && needs.changesets.outputs.agent_server_release_tag != '' }}
    uses: ./.github/workflows/agent_server_dockerhub_image.yml
    secrets: inherit
    with:
      git_ref: ${{ needs.changesets.outputs.agent_server_release_tag }}

  publish-server-rust:
    needs: changesets
    # Publishes the `durable-streams` crate (crates.io); the npm packages are
    # disabled inside server_rust_publish.yml. crates.io Trusted Publishing is
    # configured for the crate.
    if: ${{ needs.changesets.outputs.published == 'true' && needs.changesets.outputs.server_rust_needs_release == 'true' }}
    uses: ./.github/workflows/server_rust_publish.yml
    secrets: inherit
    with:
      git_ref: ${{ github.sha }}

  publish-server-rust-to-dockerhub:
    needs: [changesets, publish-server-rust]
    if: ${{ needs.changesets.outputs.published == 'true' && needs.changesets.outputs.server_rust_needs_release == 'true' }}
    uses: ./.github/workflows/server_rust_dockerhub_image.yml
    secrets: inherit
    with:
      git_ref: ${{ github.sha }}

  publish-agents-desktop:
    needs: changesets
    if: ${{ needs.changesets.outputs.published == 'true' && needs.changesets.outputs.desktop_release_tag != '' }}
    uses: ./.github/workflows/agents_desktop_build.yml
    permissions:
      contents: write
    secrets: inherit
    with:
      channel: stable
      version: ${{ needs.changesets.outputs.desktop_release_version }}
      git_ref: ${{ needs.changesets.outputs.desktop_release_tag }}
      publish: true
      sign: false
      release_tag: ${{ needs.changesets.outputs.desktop_release_tag }}
      release_name: Electric Agents Desktop v${{ needs.changesets.outputs.desktop_release_version }}

  publish-agents-mobile:
    needs: changesets
    if: ${{ needs.changesets.outputs.published == 'true' && needs.changesets.outputs.mobile_release_tag != '' }}
    uses: ./.github/workflows/agents_mobile_build.yml
    # The reusable workflow declares PR-comment permissions even when the stable
    # release channel skips those steps. GitHub validates declared permissions
    # before evaluating those conditions.
    permissions:
      actions: read
      contents: read
      issues: write
      pull-requests: write
    secrets: inherit
    with:
      channel: stable
      version: ${{ needs.changesets.outputs.mobile_release_version }}
      git_ref: ${{ needs.changesets.outputs.mobile_release_tag }}
      platform: android
      profile: production
      submit: true
      release_tag: ${{ needs.changesets.outputs.mobile_release_tag }}
      release_name: Electric Agents Mobile v${{ needs.changesets.outputs.mobile_release_version }}