name: Release

# One `vX.Y.Z` tag ships everything: the public npm packages + the ghcr image.
# pnpm publish skips versions already on the registry, so re-running is idempotent
# and only packages whose version was bumped actually publish.
# (Python SDK releases independently via publish-python-sdk.yml on `python-sdk-v*`.)

on:
  push:
    tags: ['v*']
  workflow_dispatch:
    inputs:
      docker_tag:
        description: 'Manual image tag (docker job only)'
        required: false
        default: 'latest'

jobs:
  npm:
    # Publishes the 7 public packages: @agentkitai/agentlens-{server,mcp,core,cli,sdk} + @agentkitai/auth
    # + @agentkitai/pricing (a runtime dep of @agentkitai/agentlens-core — MUST publish or core's
    # install breaks; it's in the @agentkit scope so the @agentkitai/agentlens-* glob misses it).
    # The @agentkitai/agentlens-* glob also matches the private dashboard/api-spec/sdk-integration-tests
    # packages, but `publish` skips private ones.
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write   # OIDC trusted publishing — no NPM_TOKEN needed
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
        with:
          version: 10.18.2
      # No registry-url here on purpose: setup-node would write an .npmrc with a
      # `${NODE_AUTH_TOKEN}` placeholder that breaks OIDC auth (404). Default
      # registry (registry.npmjs.org) is what trusted publishing targets anyway.
      - uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: pnpm
      # Trusted publishing needs npm CLI >= 11.5.1. pnpm 10 delegates the actual
      # publish to the npm CLI on PATH, so upgrade it before publishing.
      - run: npm install -g npm@latest
      - run: pnpm install --frozen-lockfile
      - run: pnpm build
      - run: pnpm test
      - name: Publish public packages (OIDC trusted publishing)
        # No token: npm auto-detects the GitHub OIDC environment and authenticates.
        # Provenance is generated automatically under trusted publishing.
        run: pnpm publish -r --filter "@agentkitai/agentlens-*" --filter "!@agentkitai/agentlens-relay" --filter @agentkitai/auth --filter "@agentkitai/pricing" --access public --no-git-checks

  docker:
    # Builds and pushes the public image to ghcr.io/agentkitai/agentlens using the
    # built-in GITHUB_TOKEN — no Docker Hub credentials needed.
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v7
      # docker-container driver so `cache-to: type=gha` works (the default
      # docker driver can't export cache — the build fails without this).
      - uses: docker/setup-buildx-action@v4
      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ghcr.io/agentkitai/agentlens
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest,enable=${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') }}
            type=raw,value=${{ inputs.docker_tag }},enable=${{ github.event_name == 'workflow_dispatch' }}
      - name: Build and push
        uses: docker/build-push-action@v7
        with:
          context: .
          file: Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max