release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  PACKAGE_DIR: UnityLibrary
  PACKAGE_NAME: com.intercom.unity
  NPM_VERSION: 11.15.0

jobs:
  validate:
    name: Validate tag
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
      sha: ${{ steps.resolve.outputs.sha }}
      dist_tag: ${{ steps.disttag.outputs.tag }}
      android_version: ${{ steps.native.outputs.android }}
      ios_version: ${{ steps.native.outputs.ios }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.ref }}
          persist-credentials: false
          fetch-depth: 0

      - name: Extract and validate version
        id: version
        env:
          RELEASE_TAG: ${{ github.ref_name }}
        run: |
          VERSION="${RELEASE_TAG#v}"

          if ! echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$'; then
            echo "Error: invalid version format: $VERSION"
            exit 1
          fi

          PKG_VERSION=$(node -p "require('./$PACKAGE_DIR/package.json').version")
          if [ "$VERSION" != "$PKG_VERSION" ]; then
            echo "Error: tag version ($VERSION) does not match package.json version ($PKG_VERSION)"
            exit 1
          fi

          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Refuse releases not on the default branch, pin SHA
        id: resolve
        env:
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        run: |
          HEAD_SHA="$(git rev-parse HEAD)"
          git merge-base --is-ancestor "$HEAD_SHA" "origin/$DEFAULT_BRANCH" \
            || { echo "tagged commit $HEAD_SHA is not reachable from $DEFAULT_BRANCH — refusing"; exit 1; }
          echo "sha=$HEAD_SHA" >> "$GITHUB_OUTPUT"

      - name: Resolve dist-tag (a prerelease must never go to `latest`)
        id: disttag
        env:
          VERSION: ${{ steps.version.outputs.version }}
          PRERELEASE_TAG: beta
        run: |
          case "$VERSION" in
            *-*) TAG="$PRERELEASE_TAG" ;;
            *)   TAG="latest" ;;
          esac
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"

      - name: Resolve native SDK versions
        id: native
        run: |
          DEPS="$PACKAGE_DIR/Editor/IntercomDependencies.xml"

          ANDROID_VERSIONS=$(grep -oE 'io\.intercom\.android:[a-z-]+:[0-9]+\.[0-9]+\.[0-9]+' "$DEPS" \
            | awk -F: '{print $NF}' | sort -u)
          [ -n "$ANDROID_VERSIONS" ] || { echo "Error: no Android coordinates found in $DEPS"; exit 1; }
          [ "$(echo "$ANDROID_VERSIONS" | wc -l | tr -d ' ')" = "1" ] \
            || { echo "Error: mismatched Android SDK versions in $DEPS:"; echo "$ANDROID_VERSIONS"; exit 1; }
          ANDROID="$ANDROID_VERSIONS"

          IOS=$(grep -oE 'intercom-ios-sp\.git"[[:space:]]+version="[0-9]+\.[0-9]+\.[0-9]+' "$DEPS" \
            | grep -oE '[0-9]+\.[0-9]+\.[0-9]+$')
          [ -n "$IOS" ] || { echo "Error: could not read the iOS Swift Package version from $DEPS"; exit 1; }

          echo "android=$ANDROID" >> "$GITHUB_OUTPUT"
          echo "ios=$IOS" >> "$GITHUB_OUTPUT"
          echo "Android $ANDROID / iOS $IOS"

  release:
    name: Package, stage to npm, draft release
    runs-on: ubuntu-latest
    needs: validate
    timeout-minutes: 20
    permissions:
      contents: write # gh release create
      id-token: write # npm trusted publishing (OIDC)
    env:
      VERSION: ${{ needs.validate.outputs.version }}
      SHA: ${{ needs.validate.outputs.sha }}
      DIST_TAG: ${{ needs.validate.outputs.dist_tag }}
      ANDROID_VERSION: ${{ needs.validate.outputs.android_version }}
      IOS_VERSION: ${{ needs.validate.outputs.ios_version }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ needs.validate.outputs.sha }}
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "22"
          registry-url: "https://registry.npmjs.org"
          package-manager-cache: false

      - name: Upgrade npm
        run: npm install -g "npm@$NPM_VERSION"

      # README/LICENSE live at the repo root but must ship inside the package, or the
      # Package Manager details pane and the registry listing both render empty.
      - name: Stage package-local README and LICENSE
        run: cp README.md LICENSE "$PACKAGE_DIR/"

      - name: Build UPM tarball
        run: |
          mkdir -p dist
          (cd "$PACKAGE_DIR" && npm pack --pack-destination "$GITHUB_WORKSPACE/dist")
          TARBALL="dist/$PACKAGE_NAME-$VERSION.tgz"
          [ -f "$TARBALL" ] || { echo "Error: expected $TARBALL"; ls -la dist; exit 1; }

      - name: Verify tarball contents
        run: |
          LISTING=$(tar -tzf "dist/$PACKAGE_NAME-$VERSION.tgz")
          echo "$LISTING"

          for required in \
            package/package.json \
            package/README.md \
            package/LICENSE \
            package/Runtime/ \
            package/Editor/IntercomDependencies.xml \
            package/Plugins/iOS/IntercomUnity.mm \
            package/Plugins/Android/src/
          do
            echo "$LISTING" | grep -q "^$required" \
              || { echo "Error: $required missing from tarball"; exit 1; }
          done

          # The native SDKs are resolved by EDM4U: nothing binary should ship in the package.
          if echo "$LISTING" | grep -q "xcframework"; then
            echo "Error: tarball unexpectedly contains an xcframework"
            exit 1
          fi

          # An asset with no sibling .meta is invisible to Unity and breaks the import
          # silently — no error, the type just never resolves.
          MISSING=0
          while read -r asset; do
            [ -n "$asset" ] || continue
            echo "$LISTING" | grep -qx "$asset.meta" || { echo "missing .meta for $asset"; MISSING=1; }
          done <<< "$(echo "$LISTING" | grep -E '^package/(Runtime|Editor)/[^/]+[^/.]$' | grep -v '\.meta$')"
          [ "$MISSING" = "0" ] || { echo "Error: tarball has assets with no .meta"; exit 1; }

      # Staged, not published: this reserves the version and uploads the tarball but
      # requires a manual promote on npmjs before consumers can resolve it.
      - name: Stage publish to npm
        run: |
          cd "$PACKAGE_DIR"
          npm stage publish --tag "$DIST_TAG"

      - name: Build manual-install zip
        run: |
          STAGING="$(mktemp -d)"
          tar -xzf "dist/$PACKAGE_NAME-$VERSION.tgz" -C "$STAGING"
          mv "$STAGING/package" "$STAGING/IntercomUnitySDK-v$VERSION"
          (cd "$STAGING" && zip -rq "$GITHUB_WORKSPACE/dist/IntercomUnitySDK-v$VERSION.zip" "IntercomUnitySDK-v$VERSION")

      - name: Generate checksums
        run: |
          cd dist
          sha256sum ./*.tgz ./*.zip > SHA256SUMS.txt
          cat SHA256SUMS.txt

      - name: Compose release notes
        run: |
          cat > notes.md <<'TEMPLATE'
          ## Intercom Unity SDK __VERSION__

          | Component | Version |
          | --- | --- |
          | Intercom Android SDK | `__ANDROID__` |
          | Intercom iOS SDK | `__IOS__` |
          | npm dist-tag | `__DIST_TAG__` |

          ### Install via Unity Package Manager

          Add to `Packages/manifest.json`:

          ```json
          {
            "scopedRegistries": [
              {
                "name": "Intercom",
                "url": "https://registry.npmjs.org",
                "scopes": ["com.intercom"]
              },
              {
                "name": "package.openupm.com",
                "url": "https://package.openupm.com",
                "scopes": ["com.google.external-dependency-manager"]
              }
            ],
            "dependencies": {
              "com.intercom.unity": "__VERSION__"
            }
          }
          ```

          ### Assets

          - `__PACKAGE_NAME__-__VERSION__.tgz` — UPM tarball
          - `IntercomUnitySDK-v__VERSION__.zip` — manual install bundle
          - `SHA256SUMS.txt`
          TEMPLATE

          sed -i \
            -e "s|__VERSION__|$VERSION|g" \
            -e "s|__ANDROID__|$ANDROID_VERSION|g" \
            -e "s|__IOS__|$IOS_VERSION|g" \
            -e "s|__DIST_TAG__|$DIST_TAG|g" \
            -e "s|__PACKAGE_NAME__|$PACKAGE_NAME|g" \
            notes.md
          cat notes.md

      - name: Create draft release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        run: |
          PRERELEASE=""
          case "$VERSION" in *-*) PRERELEASE="--prerelease" ;; esac

          # shellcheck disable=SC2086
          gh release create "$TAG" \
            --draft \
            $PRERELEASE \
            --title "$VERSION" \
            --notes-file notes.md \
            dist/*

      - name: Summary
        run: |
          {
            echo "### Release $VERSION prepared"
            echo
            echo "- npm: **staged** on dist-tag \`$DIST_TAG\` — promote manually on npmjs"
            echo "- GitHub release: **draft** — review assets, then publish"
            echo "- Native: Android \`$ANDROID_VERSION\` / iOS \`$IOS_VERSION\`"
            echo "- Commit: \`$SHA\`"
          } >> "$GITHUB_STEP_SUMMARY"