release.yml

name: Release (single package)

# Packagist reads tags from this repository's root composer.json.
# The webhook indexes the tag; publication succeeds only after a clean consumer installs it.
on:
  push:
    tags:
      - 'v*'

permissions:
  contents: read

jobs:
  package:
    name: Validate package (PHP ${{ matrix.php }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        php: [ '8.5.12' ]
    steps:
      - uses: actions/checkout@v4
      - uses: shivammathur/setup-php@v2
        with:
          php-version: ${{ matrix.php }}
          coverage: none
          tools: composer:v2
      - run: bash scripts/check-no-sensitive-tracked.sh
      - run: composer validate --strict
      - run: composer install --no-interaction --prefer-dist
      - run: composer check
      - run: composer mono-validate
      - run: composer test:package

  publish:
    name: Verify Packagist and publish release
    needs: package
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: write
    env:
      RELEASE_TAG: ${{ github.ref_name }}
      RELEASE_SHA: ${{ github.sha }}
    steps:
      - uses: actions/checkout@v4
      - uses: shivammathur/setup-php@v2
        with:
          php-version: '8.5.12'
          coverage: none
          tools: composer:v2
      - run: composer install --no-interaction --prefer-dist
      # Composer's own metadata endpoint, which Packagist refreshes when the webhook indexes a tag. The web API
      # (packagist.org/packages/<name>.json) is cached by the CDN for twelve hours (s-maxage=43200), so it can
      # keep answering without the new tag long after Composer already installs it.
      - name: Wait for Packagist to index this exact tag
        run: |
          # shellcheck disable=SC2016 # the PHP program is single-quoted on purpose
          for _ in $(seq 1 40); do
            if curl --fail --silent --show-error https://repo.packagist.org/p2/fireflyframework/larafly.json -o "$RUNNER_TEMP/larafly.json" &&
              php -r '$p = json_decode(file_get_contents($argv[1]), true); foreach ($p["packages"]["fireflyframework/larafly"] ?? [] as $v) { if (($v["version"] ?? null) === getenv("RELEASE_TAG")) { exit(($v["source"]["reference"] ?? null) === getenv("RELEASE_SHA") ? 0 : 1); } } exit(1);' "$RUNNER_TEMP/larafly.json"; then
              exit 0
            fi
            sleep 15
          done
          echo 'Packagist has not indexed the tagged commit. Check the repository webhook and rerun this job.' >&2
          exit 1
      - name: Install the public release and exercise its installer
        run: php scripts/check-package-install.php --published
      - uses: ./.github/actions/build-docs
      - name: Publish the verified release notes
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          python3 - <<'PY'
          import os, pathlib, re
          version = os.environ['RELEASE_TAG'].removeprefix('v')
          changelog = pathlib.Path('CHANGELOG.md').read_text()
          notes = re.search(r'^## \[' + re.escape(version) + r'\].*?\n(.*?)(?=^## \[|\Z)', changelog, re.M | re.S)
          if notes is None:
              raise SystemExit('The tag has no changelog entry')
          pathlib.Path(os.environ['RUNNER_TEMP'], 'release-notes.md').write_text(notes[1].strip() + '\n')
          PY
          gh release view "$RELEASE_TAG" >/dev/null 2>&1 ||
            gh release create "$RELEASE_TAG" --verify-tag --title "LaraFly ${RELEASE_TAG#v}" --notes-file "$RUNNER_TEMP/release-notes.md"
          gh release upload "$RELEASE_TAG" site/downloads/* --clobber