release-check.yml

name: Release Checker
on:
  workflow_call:
    inputs:
      branches:
        required: false
        type: string
        default: ${{ format('["{0}"]', github.event.repository.default_branch) }}
      sources:
        required: false
        type: string
        default: '["version.json"]'
      separator:
        required: false
        type: string
        default: '/'
    outputs:
      json:
        description: JSON aggregation of release.json artifacts
        value: ${{ jobs.aggregate.outputs.json }}

jobs:
  release-check:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        source: ${{ fromJSON(inputs.sources) }}
    steps:
      - run: echo "EOF=EOF$RANDOM" >> $GITHUB_ENV
      - id: pr
        name: Retrieve PR information
        env:
          PULL_REQUEST: ${{ toJSON(github.event.pull_request) }}
        uses: actions/github-script@v7
        with:
          script: |
            let pr = JSON.parse(process.env.PULL_REQUEST);
            if (pr == null) {
              const {data: pulls} = await github.rest.repos.listPullRequestsAssociatedWithCommit({
                owner: context.repo.owner,
                repo: context.repo.repo,
                commit_sha: context.sha
              });
              const open = pulls.filter(p => p.state == 'open');
              if (open.length == 0) {
                core.setFailed(`No open PR found for commit ${context.sha}`);
                return;
              }
              if (open.length > 1) {
                core.setFailed(`Multiple open PRs found for commit ${context.sha}`);
                return;
              }
              pr = open[0];
            }
            core.setOutput('json', JSON.stringify(pr));
      - uses: actions/checkout@v4
      - id: go-mod
        uses: ipdxco/unified-github-workflows/.github/actions/read-go-mod@main
      - uses: actions/setup-go@v5
        with:
          go-version: ${{ fromJSON(steps.go-mod.outputs.json).Go || 'stable' }}
          cache: false
      - id: version
        name: Determine version
        env:
          GITHUB_TOKEN: ${{ github.token }}
          SOURCE: ${{ matrix.source }}
          SEPARATOR: ${{ inputs.separator }}
          HEAD_FULL_NAME: ${{ fromJSON(steps.pr.outputs.json).head.repo.full_name }}
          HEAD_SHA: ${{ fromJSON(steps.pr.outputs.json).head.sha }}
        run: |
          root="$(dirname "$SOURCE")"
          source="$(basename "$SOURCE")"
          echo "root=$root" | tee -a $GITHUB_OUTPUT
          echo "source=$source" | tee -a $GITHUB_OUTPUT
          if [[ "$root" == "." ]]; then
            prefix="v"
          else
            name="$(yq -r '.package.name // .name // "'"$root"'"' "$root/$source")"
            prefix="${name}${SEPARATOR}v"
          fi
          echo "prefix=$prefix" | tee -a $GITHUB_OUTPUT
          git fetch origin "$HEAD_SHA"
          while [[ -z "$version" ]]; do
            echo "Checking $root/$source"
            if [[ -f "$root/$source" ]]; then
              git checkout "$HEAD_SHA" -- "$root/$source"
              version="$(yq -r '.workspace.package.version // .package.version // .version | select(type == "!!str")' "$root/$source")"
              git checkout HEAD -- "$root/$source"
              version="${version#v}"
            fi
            if [[ "$root" == "." ]]; then
              break
            fi
            root="$(dirname "$root")"
          done
          echo "version=$version" | tee -a $GITHUB_OUTPUT
          echo "tag=${prefix}${version}" | tee -a $GITHUB_OUTPUT
      - id: branch
        name: Check if the branch is a release branch
        if: steps.version.outputs.version != ''
        env:
          BRANCHES: ${{ inputs.branches }}
          BASE_REF: ${{ fromJSON(steps.pr.outputs.json).base.ref }}
        uses: actions/github-script@v7
        with:
          script: |
            const branches = JSON.parse(process.env.BRANCHES);
            const release = branches.some(b => {
              const regexPattern = b.replace(/\*/g, '.*');
              const regex = new RegExp(`^${regexPattern}$`);
              return regex.test(process.env.BASE_REF);
            });
            console.log(`This is a release branch: ${release}`);
            core.setOutput('release', release);
      - id: tag
        name: Check if the tag already exists
        if: steps.version.outputs.version != ''
        env:
          TAG: ${{ steps.version.outputs.tag }}
          ALLOWED: ${{ steps.branch.outputs.release == 'true' || contains(fromJSON(steps.pr.outputs.json).labels.*.name, 'release') }}
        run: |
          git fetch origin --tags
          status=0
          git rev-list "$TAG" &> /dev/null || status=$?
          if [[ $status == 0 ]]; then
            echo "exists=true" >> $GITHUB_OUTPUT
            echo "needed=false" >> $GITHUB_OUTPUT
          else
            echo "exists=false" >> $GITHUB_OUTPUT
            echo "needed=$ALLOWED" >> $GITHUB_OUTPUT
          fi
      - name: Install semver (node command line tool)
        if: steps.tag.outputs.needed == 'true'
        run: npm install -g "https://github.com/npm/node-semver#dc0fe202faaf19a545ce5eeab3480be84180a082" # v7.3.8
      - name: Check version
        if: steps.tag.outputs.needed == 'true'
        env:
          VERSION: v${{ steps.version.outputs.version }}
        # semver fails if the version is not valid (e.g. v0.1 would fail)
        run: semver "$VERSION"
      - id: prerelease
        if: steps.tag.outputs.needed == 'true'
        name: Check if this is a pre-release
        env:
          VERSION: v${{ steps.version.outputs.version }}
        # semver -r fails if the version is not valid or if it is a pre-release (e.g v0.1 or v0.1.0-rc1 would fail)
        run: echo "prerelease=$(semver -r "$VERSION" && echo false || echo true)" | tee -a $GITHUB_OUTPUT
      - id: prev
        name: Determine version number to compare to
        if: steps.tag.outputs.needed == 'true'
        env:
          PREFIX: ${{ steps.version.outputs.prefix }}
          VERSION: v${{ steps.version.outputs.version }}
          TAG: ${{ steps.version.outputs.tag }}
          PRERELEASE: ${{ steps.prerelease.outputs.prerelease }}
        # We need to determine the version number we want to compare to,
        # taking into account that this might be a (patch) release on a release branch.
        # Example:
        # Imagine a module that has releases for v0.1.0, v0.2.0, v0.3.0 and v0.3.0-rc1.
        # When trying to cut a release v0.2.1, we need to base our comparisons on v0.2.0.
        # When trying to cut a release v0.3.1 or v0.4.0, we need to base our comparisons on v0.3.0.
        # When trying to cut a release v0.3.0-rc2, we need to base our comparisons on v0.3.0-rc1.
        run: |
          git fetch origin --tags
          go install github.com/marten-seemann/semver-highest@fcdc98f8820ff0e6613c1bee071c096febd98dbf
          vs=$(git tag | grep "^${PREFIX}" | sed "s#^${PREFIX}#v#" | paste -sd , -)
          if [[ ! -z "$vs" ]]; then
            v=$(semver-highest -target "$VERSION" -versions "$vs" -prerelease="$PRERELEASE")
            status=$?
            if [[ $status != 0 ]]; then
              echo "v=$v"
              exit $status
            fi
            if [[ -n "$v" ]]; then
              echo "tag=$PREFIX${v#v}" | tee -a $GITHUB_OUTPUT
            fi
          fi
      - id: git-diff
        name: Run git diff on configuration file(s)
        if: steps.tag.outputs.needed == 'true' && steps.prev.outputs.tag != ''
        env:
          PREV_TAG: ${{ steps.prev.outputs.tag }}
        run: |
          # First get the diff for the go.mod/Cargo.toml file in the root directory...
          output=$(git diff "$PREV_TAG..HEAD" -- './go.mod' './Cargo.toml')
          # ... then get the diff for all go.mod/Cargo.toml files in subdirectories.
          # Note that this command also finds go.mod/Cargo.toml files more than one level deep in the directory structure.
          output+=$(git diff "$PREV_TAG..HEAD" -- '*/go.mod' '*/Cargo.toml')
          if [[ -z "$output" ]]; then
            output="(empty)"
          fi
          printf "output<<$EOF\n%s\n$EOF" "$output" | tee -a $GITHUB_OUTPUT
        working-directory: ${{ steps.version.outputs.root }}
      - id: language
        name: Run language specific checks
        if: steps.tag.outputs.needed == 'true' && steps.prev.outputs.tag != ''
        env:
          LANGUAGE: ${{ github.event.pull_request.base.repo.language }}
          PREV_TAG: ${{ steps.prev.outputs.tag }}
        # see https://github.com/golang/exp/commits/master/cmd/gorelease
        run: |
          git config advice.detachedHead false
          echo "output<<$EOF" >> $GITHUB_OUTPUT
          if [[ "$LANGUAGE" == "Go" ]]; then
            go mod download
            go install golang.org/x/exp/cmd/gorelease@9b4947da3948bdd8d6ae728bc4ba72b93f61e841 # https://cs.opensource.google/go/x/exp/+/9b4947da3948bdd8d6ae728bc4ba72b93f61e841
            go install github.com/smola/gocompat/cmd/gocompat@8498b97a44792a3a6063c47014726baa63e2e669 # v0.3.0
            echo "\`gorelease\` says:" >> $GITHUB_OUTPUT
            echo "\`\`\`" >> $GITHUB_OUTPUT
            echo "Run gorelease"
            ((gorelease -base "$PREV_TAG") 2>&1 || true) | tee -a $GITHUB_OUTPUT
            echo "\`\`\`" >> $GITHUB_OUTPUT
            echo "" >> $GITHUB_OUTPUT
            echo "\`gocompat\` says:" >> $GITHUB_OUTPUT
            echo "\`\`\`" >> $GITHUB_OUTPUT
            echo "Run gocompat"
            ((gocompat compare --go1compat --git-refs="$PREV_TAG..HEAD" ./...) 2>&1 || true) | tee -a $GITHUB_OUTPUT
            echo "\`\`\`" >> $GITHUB_OUTPUT
          fi
          echo "$EOF" >> $GITHUB_OUTPUT
        working-directory: ${{ steps.version.outputs.root }}
      - id: release
        if: steps.tag.outputs.needed == 'true' && fromJSON(steps.pr.outputs.json).head.repo.full_name == fromJSON(steps.pr.outputs.json).base.repo.full_name
        uses: galargh/action-gh-release@571276229e7c9e6ea18f99bad24122a4c3ec813f # https://github.com/galargh/action-gh-release/pull/1
        with:
          draft: true
          tag_name: ${{ steps.version.outputs.tag }}
          generate_release_notes: true
          target_commitish: ${{ fromJSON(steps.pr.outputs.json).base.ref }}
      - id: message
        if: steps.tag.outputs.exists == 'false'
        env:
          SOURCE: ${{ matrix.source }}
          HEADER: |
            Suggested version: `${{ steps.version.outputs.version }}`
          BODY: |
            Comparing to: [${{ steps.prev.outputs.tag }}](${{ fromJSON(steps.pr.outputs.json).base.repo.html_url }}/releases/tag/${{ steps.prev.outputs.tag }}) ([diff](${{ fromJSON(steps.pr.outputs.json).base.repo.html_url }}/compare/${{ steps.prev.outputs.tag }}..${{ fromJSON(steps.pr.outputs.json).head.label }}))

            Changes in configuration file(s):
            ```diff
            ${{ steps.git-diff.outputs.output }}
            ```

            ${{ steps.language.outputs.output }}
          BODY_ALT: |
            This is the first release of this module.

          RELEASE_BRANCH_NOTICE: |
            ## Cutting a Release (when not on `${{ inputs.branches }}`)

            This PR is targeting `${{ fromJSON(steps.pr.outputs.json).base.ref }}`, which is not any of ${{ inputs.branches }}.
            If you wish to cut a release once this PR is merged, please add the `release` label to this PR.

          DIFF_NOTICE: |
            ## Cutting a Release (and modifying non-markdown files)

            This PR is modifying both `${{ matrix.source }}` and non-markdown files.
            The Release Checker is not able to analyse files that are not checked in to `${{ fromJSON(steps.pr.outputs.json).base.ref }}`. This might cause the above analysis to be inaccurate.
            Please consider performing all the code changes in a separate PR before cutting the release.

          RELEASE_NOTICE: |
            ## Automatically created GitHub Release

            A [draft GitHub Release](${{ steps.release.outputs.url }}) has been created.
            It is going to be published when this PR is merged.
            You can modify its' body to include any release notes you wish to include with the release.

          RELEASE_NOTICE_ALT: |
            ## Automatically created GitHub Release

            Pre-creating GitHub Releases on release PRs initiated from forks is not supported.
            If you wish to prepare release notes yourself, you should create a draft GitHub Release for tag `${{ steps.version.outputs.tag }}` manually.
            The draft GitHub Release is going to be published when this PR is merged.
            If you choose not to create a draft GitHub Release, a published GitHub Released is going to be created when this PR is merged.

          BASE_REF: ${{ fromJSON(steps.pr.outputs.json).base.ref }}
          HEAD_LABEL: ${{ fromJSON(steps.pr.outputs.json).head.label }}
          HEAD_FULL_NAME: ${{ fromJSON(steps.pr.outputs.json).head.repo.full_name }}
          GITHUB_TOKEN: ${{ github.token }}
          PREV_TAG: ${{ steps.prev.outputs.tag }}
          TAG_NEEDED: ${{ steps.tag.outputs.needed }}
        run: |
          echo "output<<$EOF" >> $GITHUB_OUTPUT

          if [[ "$TAG_NEEDED" == "false" ]]; then
            echo "$RELEASE_BRANCH_NOTICE" >> $GITHUB_OUTPUT
          else
            echo "$HEADER" >> $GITHUB_OUTPUT
            if [[ "$PREV_TAG" != "" ]]; then
              echo "$BODY" >> $GITHUB_OUTPUT
            else
              echo "$BODY_ALT" >> $GITHUB_OUTPUT
            fi
            diff="$(gh api -X GET "repos/$GITHUB_REPOSITORY/compare/$BASE_REF...$HEAD_LABEL" --jq '.files | map(.filename)' | jq -r --arg source "$SOURCE" 'map(select(test("^(\($source)|.*\\.md)$") | not)) | .[]')"
            if [[ "$diff" != "" ]]; then
              echo "$DIFF_NOTICE" >> $GITHUB_OUTPUT
            fi
            if [[ "$GITHUB_REPOSITORY" == "$HEAD_FULL_NAME" ]]; then
              echo "$RELEASE_NOTICE" >> $GITHUB_OUTPUT
            else
              echo "$RELEASE_NOTICE_ALT" >> $GITHUB_OUTPUT
            fi
          fi
          echo "$EOF" >> $GITHUB_OUTPUT
      - name: Post message on PR
        uses: marocchino/sticky-pull-request-comment@331f8f5b4215f0445d3c07b4967662a32a2d3e31 # v2.9.0
        if: steps.tag.outputs.exists == 'false'
        with:
          header: release-check (${{ matrix.source }})
          recreate: true
          message: ${{ steps.message.outputs.output }}
          number: ${{ fromJSON(steps.pr.outputs.json).number }}
      - name: Create release.json
        if: steps.release.outputs.id != ''
        id: json
        env:
          SOURCE: ${{ matrix.source }}
          RELEASE: |
            {
              "draft": true,
              "version": "${{ steps.version.outputs.tag }}",
              "url": "${{ steps.release.outputs.url }}",
              "id": "${{ steps.release.outputs.id }}",
              "upload_url": "${{ steps.release.outputs.upload_url }}",
              "assets": ${{ steps.release.outputs.assets }},
              "source": "${{ matrix.source }}"
            }
        run: |
          jq . <<< "$RELEASE" > release.json
          sed 's/[":<>|*?\r\n\\\/]/_/g' <<< "$SOURCE" | xargs -I {} -0 echo "name={}" | tee -a $GITHUB_OUTPUT
      - name: Upload release.json
        if: steps.release.outputs.id != ''
        uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.json.outputs.name }}
          path: release.json
  aggregate:
    needs: [release-check]
    runs-on: ubuntu-latest
    outputs:
      json: ${{ toJSON(fromJSON(steps.aggregate.outputs.json)) }}
    steps:
      - uses: actions/download-artifact@v4
      - id: aggregate
        run: |
          echo "json<<EOF" >> $GITHUB_OUTPUT
          echo "{" | tee -a $GITHUB_OUTPUT
          for d in *; do
            f="$d/release.json"
            if [[ -d "$d" && -f "$f" ]]; then
              echo "$comma" | tee -a $GITHUB_OUTPUT
              jq .source "$f" | tee -a $GITHUB_OUTPUT
              echo ":" | tee -a $GITHUB_OUTPUT
              jq . "$f" | tee -a $GITHUB_OUTPUT
              comma=","
            fi
          done
          echo "}" | tee -a $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT