release.yml

name: Release

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      recovery_reason:
        description: "Recovery-only note for rerunning the trusted release lane"
        required: true
        type: string
      recovery_ref:
        description: "Commit SHA or tag for the exact revision being recovered"
        required: true
        type: string

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  release-please:
    name: Release Please
    runs-on: ubuntu-latest
    permissions:
      contents: write
      issues: write
      pull-requests: write
    outputs:
      release_created: ${{ steps.release.outputs.release_created || steps.manual_dispatch.outputs.release_created || 'false' }}
    steps:
      - name: Check out repository for Release Please
        if: ${{ github.event_name != 'workflow_dispatch' }}
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Confirm manual dispatch stays recovery-only
        id: manual_dispatch
        if: ${{ github.event_name == 'workflow_dispatch' }}
        shell: bash
        run: |
          echo "release_created=false" >> "$GITHUB_OUTPUT"
          echo "workflow_dispatch bypasses Release Please and exists only to recover the trusted publish lane for an exact immutable ref."

      - name: Record review-only Release Please PR posture
        if: ${{ github.event_name != 'workflow_dispatch' }}
        run: |
          echo "Release Please generated PRs are review-only. Trusted proof starts only after merge in the protected hex-publish environment."

      - name: Run Release Please
        id: release
        if: ${{ github.event_name != 'workflow_dispatch' }}
        uses: ./.github/actions/release-please
        with:
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json

  recovery-validation:
    name: Validate Recovery Ref
    if: ${{ github.event_name == 'workflow_dispatch' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      checkout_ref: ${{ steps.validate.outputs.checkout_ref }}
    steps:
      - name: Check out repository for recovery validation
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Validate recovery-only inputs and lock to an immutable ref
        id: validate
        shell: bash
        run: |
          set -euo pipefail
          test -n "${{ inputs.recovery_reason }}"
          recovery_ref="${{ inputs.recovery_ref }}"
          test -n "$recovery_ref"

          if [[ "$recovery_ref" =~ ^[0-9a-f]{40}$ ]]; then
            git cat-file -e "${recovery_ref}^{commit}"
            echo "checkout_ref=$recovery_ref" >> "$GITHUB_OUTPUT"
          elif git show-ref --verify --quiet "refs/tags/$recovery_ref"; then
            echo "checkout_ref=$recovery_ref" >> "$GITHUB_OUTPUT"
          else
            echo "workflow_dispatch is recovery-only and recovery_ref must be an exact 40-character commit SHA or an existing tag."
            exit 1
          fi

          echo "workflow_dispatch is recovery-only. Recovery publishes the exact immutable ref selected in recovery_ref, and normal publish intent starts from a merged Release Please PR and the protected hex-publish environment."

  publish:
    name: Publish to Hex
    runs-on: ubuntu-latest
    needs:
      - release-please
      - recovery-validation
    if: ${{ always() && ((github.event_name == 'workflow_dispatch' && needs.recovery-validation.result == 'success') || (github.event_name != 'workflow_dispatch' && needs.release-please.outputs.release_created == 'true')) }}
    environment: hex-publish
    permissions:
      contents: read
    steps:
      - name: Check out repository for the merged release commit
        if: ${{ github.event_name != 'workflow_dispatch' }}
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Check out repository for recovery validation
        if: ${{ github.event_name == 'workflow_dispatch' }}
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          fetch-tags: true
          ref: ${{ needs.recovery-validation.outputs.checkout_ref }}

      - name: Confirm recovery checkout is detached to the validated immutable ref
        if: ${{ github.event_name == 'workflow_dispatch' }}
        shell: bash
        run: |
          set -euo pipefail
          git checkout --detach HEAD
          echo "Recovered immutable ref: ${{ needs.recovery-validation.outputs.checkout_ref }}"

      - name: Set up Elixir and Erlang
        uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.24.0
        with:
          elixir-version: "1.19.5"
          otp-version: "28"

      - name: Install Hex and Rebar
        run: |
          mix local.hex --force
          mix local.rebar --force

      - name: Restore Mix cache
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            deps
            _build
          key: ${{ runner.os }}-mix-release-${{ hashFiles('mix.lock') }}
          restore-keys: |
            ${{ runner.os }}-mix-release-

      - name: Install dependencies
        run: mix deps.get

      - name: Run trusted release preflight inside protected environment
        env:
          HEX_API_KEY: ${{ secrets.HEX_API_KEY }}
        run: mix release.preflight

      - name: Publish package from the trusted lane
        env:
          HEX_API_KEY: ${{ secrets.HEX_API_KEY }}
        run: mix hex.publish --yes