publish-sim-cli.yml

name: publish-sim-cli

on:
  push:
    branches: [main, staging, dev]
    paths:
      - 'packages/sim-cli/**'
      # The build bundles its workspace dependencies, so a change there
      # changes what ships.
      - 'packages/utils/**'
      # A change to how the package is built or published has to republish it.
      - '.github/workflows/publish-sim-cli.yml'

permissions:
  contents: read

concurrency:
  group: publish-sim-cli-${{ github.ref }}
  cancel-in-progress: false

jobs:
  publish:
    name: publish
    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
    timeout-minutes: 15
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
        with:
          persist-credentials: false

      # Vitest 5 requires Node 22.12+; the published bundle is still
      # smoke-tested on Node 20 below, its minimum supported runtime.
      - name: Setup workspace
        uses: ./.github/actions/setup
        with:
          provider: ${{ vars.CI_PROVIDER }}
          node-version: '22'

      - name: Verify npm authentication
        env:
          NPM_CONFIG_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: bun pm whoami

      - name: Auto-bump package version
        run: bun run bump:npm-packages sim-cli

      - name: Run tests
        working-directory: packages/sim-cli
        run: bun run test

      - name: Type-check package
        working-directory: packages/sim-cli
        run: bun run type-check

      # The usage-reporting destination is baked into the bundle at build time
      # (docs/cli/usage-data), so only the two steps that build it get the
      # token. Every other step, the tests above in particular, runs without
      # it: a test that runs a real command must never report to production.
      - name: Build package
        working-directory: packages/sim-cli
        env:
          SIM_CLI_TELEMETRY_KEY: ${{ vars.SIM_CLI_TELEMETRY_KEY }}
          SIM_CLI_TELEMETRY_HOST: ${{ vars.SIM_CLI_TELEMETRY_HOST }}
        run: bun run build

      - name: Resolve release channel
        id: release
        working-directory: packages/sim-cli
        env:
          BRANCH: ${{ github.ref_name }}
        run: |
          BASE_VERSION="$(bun -p "require('./package.json').version")"
          if [[ ! "$BASE_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "Package version must be a stable X.Y.Z base, got '$BASE_VERSION'." >&2
            exit 1
          fi

          case "$BRANCH" in
            dev)
              VERSION="${BASE_VERSION}-dev.${GITHUB_RUN_NUMBER}.${GITHUB_RUN_ATTEMPT}"
              TAG="dev"
              ;;
            staging)
              VERSION="${BASE_VERSION}-preview.${GITHUB_RUN_NUMBER}.${GITHUB_RUN_ATTEMPT}"
              TAG="staging"
              ;;
            main)
              VERSION="$BASE_VERSION"
              TAG="latest"
              ;;
            *)
              echo "Unsupported release branch '$BRANCH'." >&2
              exit 1
              ;;
          esac

          bun pm pkg set "version=$VERSION"
          RESOLVED_VERSION="$(bun -p "require('./package.json').version")"
          if [ "$RESOLVED_VERSION" != "$VERSION" ]; then
            echo "Version injection mismatch: wanted '$VERSION', got '$RESOLVED_VERSION'." >&2
            exit 1
          fi

          {
            echo "version=$VERSION"
            echo "tag=$TAG"
          } >> "$GITHUB_OUTPUT"

      - name: Setup Node 20 for the bundle smoke test
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
        with:
          node-version: '20'

      - name: Smoke-test packed Node bundle
        working-directory: packages/sim-cli
        run: |
          set -euo pipefail
          SMOKE_DIR="$(mktemp -d "$RUNNER_TEMP/sim-cli-smoke.XXXXXX")"
          PACKAGE_PATH="$SMOKE_DIR/sim-cli.tgz"
          bun pm pack --ignore-scripts --filename "$PACKAGE_PATH" --quiet
          tar -xzf "$PACKAGE_PATH" -C "$SMOKE_DIR"
          "$SMOKE_DIR/package/dist/index.js" --version

      - name: Verify version is unpublished
        working-directory: packages/sim-cli
        env:
          VERSION: ${{ steps.release.outputs.version }}
        run: |
          if bun pm view "sim@$VERSION" version > /dev/null 2>&1; then
            echo "sim@$VERSION is already published. The automatic version bump did not produce a unique release." >&2
            exit 1
          fi

      # `bun publish` runs `prepublishOnly`, which rebuilds `dist`, and that
      # rebuild is what ships, so it needs the token as well.
      - name: Publish to npm
        working-directory: packages/sim-cli
        env:
          NPM_CONFIG_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_TAG: ${{ steps.release.outputs.tag }}
          SIM_CLI_TELEMETRY_KEY: ${{ vars.SIM_CLI_TELEMETRY_KEY }}
          SIM_CLI_TELEMETRY_HOST: ${{ vars.SIM_CLI_TELEMETRY_HOST }}
        run: bun publish --access public --tag "$NPM_TAG" --no-save

      - name: Summarize release
        env:
          VERSION: ${{ steps.release.outputs.version }}
          NPM_TAG: ${{ steps.release.outputs.tag }}
        run: echo "Published sim@$VERSION with the '$NPM_TAG' tag."