release.yml

# Release workflow — runs on tag push (v*).
#
# Composer packages on public packagist.org auto-sync from the configured Git
# repository via push-event webhook (https://packagist.org/api/github), so
# this workflow's primary job is to (1) re-run the CI gates on the tagged
# commit and (2) create a GitHub release pointing at the changelog entry.
#
# OIDC Trusted Publishing on Packagist is currently a Private Packagist–only
# feature (packagist/artifact-publish-github-action); public packagist.org
# has no OIDC option today. Migrating would change ally-side Composer
# consumption (private repo URL + token in composer.json) and is a commercial
# decision tracked in Issue #11 — out of scope for this workflow until adopted.

name: Release

on:
    push:
        tags:
            - 'v*'

jobs:
    verify:
        runs-on: ubuntu-latest
        strategy:
            fail-fast: false
            matrix:
                php: ['8.4', '8.5']
        steps:
            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

            - name: Setup PHP ${{ matrix.php }}
              uses: shivammathur/setup-php@728c6c6b8cf02c2e48117716a91ee48313958a19 # v2
              with:
                  php-version: ${{ matrix.php }}
                  coverage: none
                  tools: composer:v2

            - name: Install dependencies
              run: composer install --prefer-dist --no-progress --no-interaction

            - name: Format check
              run: composer format:check

            - name: Static analysis
              run: composer phpstan

            - name: Tests
              run: composer test

    release:
        needs: verify
        runs-on: ubuntu-latest
        permissions:
            contents: write
        steps:
            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
              with:
                  fetch-depth: 0

            - name: Extract changelog for tag
              id: changelog
              run: |
                  set -euo pipefail
                  TAG="${GITHUB_REF#refs/tags/}"
                  VERSION="${TAG#v}"
                  awk -v ver="$VERSION" '
                      /^## \[/ {
                          if (found) exit
                          if ($0 ~ "\\[" ver "\\]") found = 1
                          next
                      }
                      found { print }
                  ' CHANGELOG.md > release-notes.md

                  # WR-0852: awk exits 0 having printed nothing when the tag has
                  # no matching heading, so `set -euo pipefail` catches nothing
                  # and `gh release create --notes-file` publishes an EMPTY
                  # release on a green job. Whitespace-only counts as empty: a
                  # heading with no body under it is the same silent outcome.
                  if ! grep -q '[^[:space:]]' release-notes.md; then
                      echo "::error::CHANGELOG.md has no content under a [$VERSION] heading (tag $TAG), so the release would publish with empty notes."
                      echo "Headings present in CHANGELOG.md:"
                      grep '^## \[' CHANGELOG.md || echo "  (none — the file has no version headings at all)"
                      exit 1
                  fi

                  echo "tag=$TAG" >> "$GITHUB_OUTPUT"

            - name: Create GitHub release
              env:
                  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
              run: |
                  gh release create "${{ steps.changelog.outputs.tag }}" \
                      --title "${{ steps.changelog.outputs.tag }}" \
                      --notes-file release-notes.md