cli-release.yml

name: CLI release
on:
  push:
    tags: ['v*']
  pull_request:
    paths:
      - '.github/workflows/cli-release.yml'
      - 'scripts/build.mjs'
      - 'scripts/*cli-release.mjs'
      - 'scripts/release-cli.mjs'
      - 'scripts/lib/cli-release.mjs'
      - 'scripts/verify.mjs'
      - 'test/smoke.test.mjs'
      - 'test/byok.test.mjs'
      - 'pnpm-lock.yaml'
      - 'package.json'
      - 'packages/tui/package.json'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Optional tag matching the source version (dry run; does not publish)'
        required: false
        type: string
permissions:
  contents: read
concurrency:
  group: cli-release-${{ inputs.tag || github.ref }}
  cancel-in-progress: false
jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 25
    outputs:
      version: ${{ steps.release.outputs.version }}
      matrix: ${{ steps.release.outputs.matrix }}
      tag: ${{ steps.release.outputs.tag }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          cache: pnpm
      - name: Validate release version and revision
        id: release
        shell: bash
        run: |
          node --input-type=module -e 'import { appendFileSync } from "node:fs"; import { cliBuildVersion, cliReleaseTargets } from "./scripts/lib/cli-release.mjs"; const tag = process.env.REQUESTED_TAG || `v${cliBuildVersion(process.cwd())}`; const version = cliBuildVersion(process.cwd(), tag); appendFileSync(process.env.GITHUB_OUTPUT, `version=${version}\ntag=${tag}\nmatrix=${JSON.stringify({include: cliReleaseTargets})}\n`); appendFileSync(process.env.GITHUB_ENV, `MCODE_RELEASE_TAG=${tag}\n`);'
          if [ "$EVENT_NAME" = push ]; then
            test "$(git rev-parse "refs/tags/$REQUESTED_TAG^{commit}")" = "$(git rev-parse HEAD)"
          fi
        env:
          EVENT_NAME: ${{ github.event_name }}
          REQUESTED_TAG: ${{ inputs.tag || (github.event_name == 'push' && github.ref_name) || '' }}
      - run: pnpm install --frozen-lockfile
      - uses: ./.github/actions/setup-gitleaks
      - name: Scan source history
        run: gitleaks git --redact --config .gitleaks.toml --log-opts=--all
      - run: pnpm verify
        env:
          MCODE_VERIFY_REPORT_DIR: ${{ runner.temp }}/build-report
      - name: Scan distribution
        run: gitleaks dir dist --redact --config .gitleaks.toml
      - name: Package the tagged CLI
        shell: bash
        run: node scripts/package-cli-release.mjs "$MCODE_RELEASE_TAG" "$RUNNER_TEMP/package"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: cli-package
          path: ${{ runner.temp }}/package/
          retention-days: 14
          if-no-files-found: error
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: ${{ always() }}
        with:
          name: cli-build-report
          path: ${{ runner.temp }}/build-report/
          retention-days: 14
  install:
    needs: build
    env:
      MCODE_RELEASE_TAG: ${{ needs.build.outputs.tag }}
    runs-on: ${{ matrix.os }}
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.build.outputs.matrix) }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ matrix.node }}
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: cli-package
          path: ${{ runner.temp }}/package
      - run: pnpm verify --profile package
        env:
          MCODE_RELEASE_ARCHIVE: ${{ runner.temp }}/package/minimax-code-${{ needs.build.outputs.version }}.tar.gz
          MCODE_VERIFY_REPORT_DIR: ${{ runner.temp }}/install-report
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: ${{ always() }}
        with:
          name: cli-install-${{ matrix.os }}-${{ matrix.node }}
          path: ${{ runner.temp }}/install-report/
          retention-days: 14
  publish:
    needs: [build, install]
    if: github.event_name == 'push'
    permissions:
      contents: write
    runs-on: ubuntu-latest
    timeout-minutes: 5
    env:
      MCODE_RELEASE_TAG: ${{ needs.build.outputs.tag }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: '24'
          package-manager-cache: false
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: cli-package
          path: ${{ runner.temp }}/package
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          pattern: cli-install-*
          path: ${{ runner.temp }}/reports
      - name: Publish only the authenticated, validated archive
        run: node scripts/publish-cli-release.mjs
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          MCODE_RELEASE_DIRECTORY: ${{ runner.temp }}/package
          MCODE_RELEASE_REPORTS: ${{ runner.temp }}/reports