cd.yml

name: 🚀 CD

on:
  push:
    branches: [master]

permissions:
  contents: write # Needed for creating commits and tags
  id-token: write # Needed for npm provenance authentication

jobs:
  release:
    name: 🚀 Release
    runs-on: ubuntu-latest
    if: ${{ !contains(github.event.head_commit.message, 'chore(release):') && !contains(github.event.head_commit.message, '[skip release]') }}
    steps:
      - name: 📥 Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Important for Nx to analyze git history
          token: ${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}

      - name: 📦 Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10.14.0

      - name: 🏗️ Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          registry-url: "https://registry.npmjs.org"
          cache: "pnpm"

      - name: 📦 Install dependencies
        run: pnpm install --frozen-lockfile

      - name: ⚙️ Git Configuration
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: 🔖 Version & Changelog
        # Calculates versions, updates changelogs, creates commit and tag
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Ensure git user is configured
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          # Run versioning (Nx modifies files locally)
          pnpm nx release version --git-commit --git-tag

          # Manual Safety Net: Commit and Push
          # 1. If Nx made a commit but didn't push -> We push.
          # 2. If Nx modified files but didn't commit -> We commit and push.

          if [[ -n $(git status -s) ]]; then
            echo "📝 Changes detected (Nx didn't commit). Committing manually..."
            git add .
            git commit -m "chore(release): publish [skip ci]"
          else
            echo "✅ No uncommitted changes found (Nx likely committed)."
          fi

          echo "🚀 Pushing changes and tags to remote..."
          git push origin HEAD --follow-tags

      - name: 🏗️ Build
        # Builds projects with the updated version before publishing
        run: pnpm nx run-many -t build --all

      - name: 🚀 Publish
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed for creating GitHub Releases
        # Publishes packages to npm and creates GitHub Releases
        run: pnpm nx release publish