release.yml

name: 'Ionic Production Release'

on:
  workflow_call:
    inputs:
      version:
        description: 'Which version should be published?'
        required: true
        type: string
      tag:
        description: 'Which npm tag should this be published to?'
        required: true
        type: string
      preid:
        description: 'Which prerelease identifier should be used? This is only needed when version is "prepatch", "preminor", "premajor", or "prerelease".'
        required: false
        type: string

permissions:
  contents: read
  id-token: write

jobs:
  validate_version:
    name: ✅ Validate Version Input
    runs-on: ubuntu-latest
    steps:
      - name: 🔎 Ensure version is allowed
        env:
          VERSION: ${{ inputs.version }}
        run: |
          case "$VERSION" in
            patch|minor|major|prepatch|preminor|premajor|prerelease)
              exit 0
              ;;
            *)
              echo "::error::Invalid version input: '$VERSION'. Allowed values: patch, minor, major, prepatch, preminor, premajor, prerelease."
              exit 1
              ;;
          esac
        shell: bash

  release-ionic:
    needs: [validate_version]
    permissions:
      contents: read
      id-token: write
    uses: ./.github/workflows/release-ionic.yml
    with:
      tag: ${{ inputs.tag }}
      version: ${{ inputs.version }}
      preid: ${{ inputs.preid }}

  finalize-release:
    needs: [release-ionic]
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        token: ${{ secrets.IONITRON_TOKEN }}
        fetch-depth: 0
    - name: Configure Identity
      # Commits from github-actions do not
      # trigger other GitHub Actions. As a result,
      # we publish releases from Ionitron instead
      # so actions run when merging the release branch
      # back into main.
      run: |
        git config user.name ionitron
        git config user.email hi@ionicframework.com
      shell: bash
    - name: Create GitHub Release
      run: lerna version ${{ inputs.version }} --yes --force-publish='*' --conventional-commits --create-release github --preid=${{ inputs.preid }}
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      shell: bash

  update-package-lock:
    # This needs to run after finalize-release
    # because we also push to the repo in that
    # job. If these jobs ran in parallel then it is
    # possible for them to push at the same time.
    needs: [finalize-release]
    runs-on: ubuntu-latest
    # This is a backstop for the retry loop in
    # Resolve Package Locks, which fails with its
    # own message first.
    timeout-minutes: 30
    permissions:
      contents: write
      id-token: write
    outputs:
      # This says the new versions resolved on npm,
      # which is not the same as the job passing.
      resolved: ${{ steps.resolve.outputs.resolved }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        # Pull the latest version of the reference
        # branch instead of the revision that triggered
        # the workflow otherwise we won't get the commit
        # created in the previous job and this next job
        # will fail.
        with:
          ref: ${{ github.ref }}
      - name: Configure Identity
        # Commits from github-actions do not
        # trigger other GitHub Actions. As a result,
        # we push from Ionitron instead so actions
        # run when merging the release branch
        # back into main.
        run: |
          git config user.name ionitron
          git config user.email hi@ionicframework.com
        shell: bash
      # Lerna does not automatically bump versions
      # of Ionic dependencies that have changed, so
      # we do that here. The install fails with
      # ETARGET until the versions published earlier
      # resolve on npm, so retry. The
      # `--prefer-online` flag matters because npm
      # caches the failed lookup, and an `npm view`
      # probe would read a different cached document.
      - name: Resolve Package Locks
        id: resolve
        env:
          SLEEP_SECONDS: 15
          DEADLINE_SECONDS: 900
        run: |
          set -euo pipefail
          # We bound this on the wall clock so the loop reports its own
          # error before `timeout-minutes` kills the job. The `timeout`
          # call caps an attempt that hangs rather than fails, which would
          # never reach the check below.
          deadline=$(( SECONDS + DEADLINE_SECONDS ))
          attempt=0
          until timeout --kill-after=30 300 lerna exec "npm install --package-lock-only --prefer-online"; do
            attempt=$(( attempt + 1 ))
            if [ "$SECONDS" -ge "$deadline" ]; then
              echo "::error::npm install --package-lock-only failed $attempt times over ${SECONDS}s; see the last attempt above for the error"
              exit 1
            fi
            echo "Attempt $attempt failed, retrying in ${SLEEP_SECONDS}s"
            sleep "$SLEEP_SECONDS"
          done
          echo "resolved=true" >> "$GITHUB_OUTPUT"
        shell: bash
      # This is split from the retry so `resolved`
      # does not depend on the commit and the push
      # working.
      - name: Commit Package Locks
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          git add .
          # Re-running this job after the locks were already committed
          # would otherwise fail on an empty commit.
          if git diff --cached --quiet; then
            echo "No package lock changes to commit"
            exit 0
          fi
          git commit -m "chore(): update package lock files"
          git push
        shell: bash

  purge-cdn-cache:
    # This runs after `update-package-lock` so the
    # new versions have resolved on npm. Purging
    # earlier re-caches `@ionic/core@latest` at the
    # previous release. A failed `finalize-release`
    # skips this too, so a half-finished release
    # that did reach npm needs a manual purge.
    needs: [update-package-lock]
    if: ${{ !cancelled() && needs.update-package-lock.outputs.resolved == 'true' }}
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Purge JSDelivr Cache
        run: |
          set -euo pipefail
          if ! response=$(curl -sS --max-time 60 --retry 3 --retry-all-errors \
            --retry-max-time 120 \
            -w '\n%{http_code}' -X POST \
            https://purge.jsdelivr.net/ \
            -H 'cache-control: no-cache' \
            -H 'content-type: application/json' \
            -d '{
          "path": [
            "/npm/@ionic/core@6/dist/ionic/ionic.esm.js",
            "/npm/@ionic/core@7/dist/ionic/ionic.esm.js",
            "/npm/@ionic/core@8/dist/ionic/ionic.esm.js",
            "/npm/@ionic/core@9/dist/ionic/ionic.esm.js",
            "/npm/@ionic/core@latest/dist/ionic/ionic.esm.js",
            "/npm/@ionic/core@next/dist/ionic/ionic.esm.js",
            "/npm/@ionic/core@6/css/ionic.bundle.css",
            "/npm/@ionic/core@7/css/ionic.bundle.css",
            "/npm/@ionic/core@8/css/ionic.bundle.css",
            "/npm/@ionic/core@9/css/ionic.bundle.css",
            "/npm/@ionic/core@latest/css/ionic.bundle.css",
            "/npm/@ionic/core@next/css/ionic.bundle.css"
          ]}'); then
            echo "::warning::jsDelivr purge request failed"
            exit 0
          fi
          status=${response##*$'\n'}
          echo "${response%$'\n'*}"
          # `curl` exits 0 whatever jsDelivr answers, so check the status.
          # A 4xx means we sent a bad payload, which is otherwise silent.
          # Anything else is jsDelivr being down, which should not fail
          # a release.
          case "$status" in
            2*) ;;
            4*) echo "::error::jsDelivr rejected the purge with HTTP $status"; exit 1 ;;
            *) echo "::warning::jsDelivr purge did not complete (HTTP $status)" ;;
          esac
        shell: bash