release.yml

name: Release

on:
  release:
    types: [published]

permissions:
  contents: read
  id-token: write

concurrency:
  group: release-${{ github.event.release.tag_name }}
  cancel-in-progress: false

jobs:
  publish:
    runs-on: ubuntu-latest
    timeout-minutes: 40
    env:
      RELEASE_TAG: ${{ github.event.release.tag_name }}
      PRERELEASE: ${{ github.event.release.prerelease }}
      HOST_REF: dsh-v0.2.1-rc.2
      MINIMUM_HOST_REF: dsh-v0.2.0-rc.1

    steps:
      # actions/checkout@v4
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
        with:
          ref: ${{ github.event.release.tag_name }}

      # actions/setup-node@v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
        with:
          node-version: 24
          registry-url: https://registry.npmjs.org

      # pnpm/action-setup@v4
      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
        with:
          version: 11.7.0

      # npm Trusted Publishing requires npm >= 11.5.1. Keep the release job
      # independent from whichever npm minor happens to ship with Node 24.
      - name: Upgrade npm for trusted publishing
        run: npm install --global 'npm@^11.5.1'

      - name: Verify release version
        id: release
        shell: bash
        run: |
          VERSION="$(node -p "require('./package.json').version")"

          if [ "$RELEASE_TAG" != "v$VERSION" ]; then
            echo "::error::release tag ($RELEASE_TAG) does not match package.json version (v$VERSION)"
            exit 1
          fi

          VERSION_PRERELEASE="$(node -e 'console.log(process.argv[1].split("+")[0].includes("-") ? "true" : "false")' "$VERSION")"
          if [ "$PRERELEASE" != "$VERSION_PRERELEASE" ]; then
            echo "::error::package version prerelease state ($VERSION_PRERELEASE) does not match GitHub release prerelease state ($PRERELEASE)"
            exit 1
          fi

          if [ "$PRERELEASE" = "true" ]; then
            echo "npm_tag=preview" >> "$GITHUB_OUTPUT"
          else
            echo "npm_tag=latest" >> "$GITHUB_OUTPUT"
            # Never move the public `latest` dist-tag backwards: re-publishing
            # a stale or recreated release would silently downgrade every
            # exact-version pin that DSH Desktop installs (#59).
            PUBLISHED="$(npm view @changfenhuang/dsh-genui version)"
            if [ -n "$PUBLISHED" ]; then
              BELOW="$(node -e '
                const core = (s) => s.replace(/^v/, "").split("-")[0].split(".").map(Number);
                const below = (t, p) => {
                  for (let i = 0; i < Math.max(t.length, p.length); i++) {
                    if ((t[i] ?? 0) < (p[i] ?? 0)) return true;
                    if ((t[i] ?? 0) > (p[i] ?? 0)) return false;
                  }
                  return false;
                };
                console.log(below(core(process.argv[1]), core(process.argv[2])) ? "yes" : "no");
              ' "v$VERSION" "$PUBLISHED")"
              if [ "$BELOW" = "yes" ]; then
                echo "::error::refusing to publish v$VERSION below the already-published latest ($PUBLISHED)"
                exit 1
              fi
            fi
          fi

      # 固定标签的宿主用于 packed e2e；API 检查单独安装发布包类型声明。
      - name: Clone DSH host
        shell: bash
        run: |
          DSH_ROOT="$GITHUB_WORKSPACE/../../.dsh/source/current"
          mkdir -p "$(dirname "$DSH_ROOT")"
          git clone --depth 1 --branch "$HOST_REF" https://github.com/deepseek-ai/deepseek-harness.git "$DSH_ROOT"
          test -f "$DSH_ROOT/packages/client/ui-primitives/src/index.ts" || {
            echo "::error::DSH host preflight failed: ui-primitives source is missing"
            exit 1
          }

      - name: Install and build DSH host
        working-directory: ${{ github.workspace }}/../../.dsh/source/current
        run: |
          pnpm install --frozen-lockfile
          pnpm run build

      - name: Install plugin dependencies
        run: pnpm install --frozen-lockfile

      - name: Check
        run: pnpm run check

      - name: Check published host API
        run: pnpm run check:host-api "$HOST_REF"

      - name: Check minimum published host API
        run: pnpm run check:host-api "$MINIMUM_HOST_REF"

      - name: Verify and pack plugin tarball
        id: pack
        run: node scripts/verify-pack.mjs --keep

      - name: Smoke selected release channel
        run: node scripts/e2e.mjs --smoke --install tarball --tarball "${{ steps.pack.outputs.tarball }}" --tarball-sha256 "${{ steps.pack.outputs.sha256 }}" --port 3190
        env:
          DSH_ROOT: ${{ github.workspace }}/../../.dsh/source/current
          DSH_BIN: ${{ github.workspace }}/../../.dsh/source/current/apps/cli/lib/bin.js

      - name: Publish to npm
        run: npm publish "${{ steps.pack.outputs.tarball }}" --access public --tag "${{ steps.release.outputs.npm_tag }}"