release.yml

name: prerelease

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      release_ref:
        description: 'Optional tag or branch to validate and publish. Leave blank to use the workflow ref.'
        required: false
        default: ''
        type: string
      publish_to_nuget:
        description: 'Push downloaded prerelease packages to nuget.org using the NUGET_API_KEY secret.'
        required: false
        default: false
        type: boolean

permissions:
  contents: write

env:
  NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages

concurrency:
  group: prerelease-${{ github.ref }}
  cancel-in-progress: false

jobs:
  windows-release-validation:
    name: windows-release-validation
    runs-on: windows-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_ref || github.ref }}

      - name: Resolve release tag context
        id: release_context
        shell: pwsh
        run: |
          $releaseRef = if ($env:GITHUB_EVENT_NAME -eq 'workflow_dispatch' -and -not [string]::IsNullOrWhiteSpace('${{ inputs.release_ref }}')) {
            '${{ inputs.release_ref }}'.Trim()
          } else {
            $env:GITHUB_REF_NAME
          }

          if ($releaseRef.StartsWith('refs/tags/', [System.StringComparison]::OrdinalIgnoreCase)) {
            $releaseTag = $releaseRef.Substring('refs/tags/'.Length)
          }
          elseif ($releaseRef.StartsWith('v', [System.StringComparison]::OrdinalIgnoreCase)) {
            $releaseTag = $releaseRef
          }
          else {
            $releaseTag = ''
          }

          "release_tag=$releaseTag" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append

      - name: Prepare NuGet cache directory
        shell: pwsh
        run: New-Item -ItemType Directory -Force -Path $env:NUGET_PACKAGES | Out-Null

      - name: Setup .NET SDK
        uses: actions/setup-dotnet@v5
        with:
          global-json-file: global.json
          cache: true
          cache-dependency-path: |
            global.json
            Directory.Build.props
            NuGet.Config
            NuGet.config.sample
            **/*.csproj

      - name: Validate tag matches package version
        if: ${{ steps.release_context.outputs.release_tag != '' }}
        shell: pwsh
        run: |
          [xml]$props = Get-Content -LiteralPath 'Directory.Build.props'
          $packageVersion = @($props.Project.PropertyGroup.Version) |
            Where-Object { -not [string]::IsNullOrWhiteSpace([string]$_) } |
            Select-Object -First 1

          if ([string]::IsNullOrWhiteSpace($packageVersion)) {
            throw 'Directory.Build.props does not define a non-empty package version.'
          }

          $expectedTag = "v$packageVersion"
          $actualTag = '${{ steps.release_context.outputs.release_tag }}'

          if ($actualTag -ne $expectedTag) {
            throw "Public prerelease tag '$actualTag' does not match package version '$expectedTag'."
          }

      - name: Validate public version docs
        shell: pwsh
        run: |
          $publicTag = '${{ steps.release_context.outputs.release_tag }}'
          $validationArgs = @{
            RepoRoot = $PWD.Path
          }
          if (-not [string]::IsNullOrWhiteSpace($publicTag)) {
            $validationArgs['PublicTag'] = $publicTag
          }

          .\eng\validate-public-versioning.ps1 @validationArgs

      - name: Run release validation lane
        shell: pwsh
        run: .\eng\ci.ps1 -Lane release -Framework all -Configuration Release

      - name: Upload prerelease artifacts
        uses: actions/upload-artifact@v6
        with:
          name: prerelease-artifacts
          path: |
            artifacts/packages/**
            artifacts/proof/**
            artifacts/coverage/**
            artifacts/test-results/**
          if-no-files-found: error

      - name: Publish prerelease summary
        if: always()
        shell: pwsh
        run: |
          $summaryLines = [System.Collections.Generic.List[string]]::new()
          $summaryLines.Add('## Prerelease Validation Summary')
          $summaryLines.Add('')

          if (Test-Path -LiteralPath 'artifacts/proof/hostsample-packed.txt') {
            $hostLine = Select-String -Path 'artifacts/proof/hostsample-packed.txt' -Pattern 'HOST_SAMPLE_OK' | Select-Object -First 1
            if ($hostLine) {
              $summaryLines.Add("- $($hostLine.Line)")
            }
          }

          if (Test-Path -LiteralPath 'artifacts/proof/consumer-sample.txt') {
            foreach ($markerId in @(
              'CONSUMER_SAMPLE_OK',
              'GRAPH_ERROR_HELP_TARGET_OK',
              'GRAPH_PROBLEM_INSPECTOR_HELP_TARGET_OK',
              'REPAIR_HELP_REVIEW_LOOP_OK'
            )) {
              $consumerSampleLine = Select-String -Path 'artifacts/proof/consumer-sample.txt' -Pattern $markerId | Select-Object -First 1
              if ($consumerSampleLine) {
                $summaryLines.Add("- $($consumerSampleLine.Line)")
              }
            }
          }

          if (Test-Path -LiteralPath 'artifacts/proof/demo-proof.txt') {
            foreach ($markerId in @(
              'DEMO_OK',
              'COMMAND_SURFACE_OK',
              'TIERED_NODE_SURFACE_OK',
              'FIXED_GROUP_FRAME_OK',
              'NON_OBSCURING_EDITING_OK',
              'VISUAL_SEMANTICS_OK',
              'HIERARCHY_SEMANTICS_OK',
              'CUSTOM_TEMPLATE_OK',
              'TOOL_PROVIDER_OK',
              'NATIVE_INTERACTION_A11Y_OK',
              'DEMO_GESTURE_PROOF_OK',
              'COMPOSITE_SCOPE_OK',
              'EDGE_NOTE_OK',
              'EDGE_GEOMETRY_OK',
              'DISCONNECT_FLOW_OK',
              'SCENARIO_LAUNCH_OK',
              'SCENARIO_TOUR_OK',
              'AI_PIPELINE_MOCK_RUNNER_OK',
              'AI_PIPELINE_RUNTIME_OVERLAY_OK',
              'AI_PIPELINE_ERROR_STATE_OK',
              'AI_PIPELINE_MOCK_RUNNER_POLISH_OK',
              'AI_PIPELINE_PAYLOAD_PREVIEW_OK',
              'AI_PIPELINE_ERROR_DEBUG_EVIDENCE_OK',
              'WORKBENCH_COMMAND_RECOVERY_OK',
              'WORKBENCH_COMMAND_ACTION_GUIDANCE_OK',
              'WORKBENCH_COMMAND_SCOPE_BOUNDARY_OK',
              'DISCOVERY_TO_ACTION_FLOW_OK',
              'DISCOVERY_EMPTY_STATE_GUIDANCE_OK',
              'DISCOVERY_ACTION_SCOPE_BOUNDARY_OK',
              'WORKBENCH_EXPORT_AFFORDANCE_OK',
              'WORKBENCH_SHARE_EVIDENCE_OK',
              'WORKBENCH_EXPORT_SCOPE_BOUNDARY_OK',
              'WORKBENCH_FEATURE_DEPTH_HANDOFF_OK',
              'WORKBENCH_FEATURE_DEPTH_SCOPE_BOUNDARY_OK',
              'V065_MILESTONE_PROOF_OK',
              'API_SURFACE_BASELINE_OK',
              'API_CANONICAL_ROUTES_OK',
              'API_PACKAGE_BOUNDARY_OK'
            )) {
              $markerLine = Select-String -Path 'artifacts/proof/demo-proof.txt' -Pattern $markerId | Select-Object -First 1
              if ($markerLine) {
                $summaryLines.Add("- $($markerLine.Line)")
              }
            }
          }

          if (Test-Path -LiteralPath 'artifacts/proof/hostsample-net10-packed.txt') {
            $hostNet10Line = Select-String -Path 'artifacts/proof/hostsample-net10-packed.txt' -Pattern 'HOST_SAMPLE_NET10_OK' | Select-Object -First 1
            if ($hostNet10Line) {
              $summaryLines.Add("- $($hostNet10Line.Line)")
            }
          }

          if (Test-Path -LiteralPath 'artifacts/proof/package-smoke.txt') {
            $packageLine = Select-String -Path 'artifacts/proof/package-smoke.txt' -Pattern 'PACKAGE_SMOKE_OK' | Select-Object -First 1
            if ($packageLine) {
              $summaryLines.Add("- $($packageLine.Line)")
            }
          }

          if (Test-Path -LiteralPath 'artifacts/proof/wpf-adapter-capability-matrix.txt') {
            foreach ($matrixLine in Select-String -Path 'artifacts/proof/wpf-adapter-capability-matrix.txt' -Pattern 'ADAPTER_CAPABILITY_MATRIX' | Select-Object -ExpandProperty Line) {
              $summaryLines.Add("- $matrixLine")
            }
          }

          if (Test-Path -LiteralPath 'artifacts/proof/hello-world-wpf-proof.txt') {
            $helloWorldWpfLine = Select-String -Path 'artifacts/proof/hello-world-wpf-proof.txt' -Pattern '^HELLOWORLD_WPF_OK:True$' | Select-Object -First 1
            if ($helloWorldWpfLine) {
              $summaryLines.Add("- $($helloWorldWpfLine.Line)")
            }
            foreach ($adapter2Marker in @('ADAPTER2_VALIDATION_SCOPE_OK:True', 'ADAPTER2_MATRIX_HANDOFF_OK:True', 'ADAPTER2_SCOPE_BOUNDARY_OK:True', 'ADAPTER2_WPF_SAMPLE_PROOF_OK:True', 'ADAPTER2_CANONICAL_ROUTE_OK:True', 'ADAPTER2_SAMPLE_SCOPE_BOUNDARY_OK:True', 'ADAPTER2_PERFORMANCE_ACCESSIBILITY_HANDOFF_OK:True', 'ADAPTER2_RECIPE_ALIGNMENT_OK:True', 'ADAPTER2_PROOF_BUDGET_OK:True', 'ADAPTER2_VALIDATION_HANDOFF_OK:True', 'ADAPTER2_VALIDATION_SCOPE_BOUNDARY_OK:True', 'V060_MILESTONE_PROOF_OK:True')) {
              $adapter2Line = Select-String -Path 'artifacts/proof/hello-world-wpf-proof.txt' -Pattern "^$([regex]::Escape($adapter2Marker))$" | Select-Object -First 1
              if ($adapter2Line) {
                $summaryLines.Add("- $($adapter2Line.Line)")
              }
            }
          }

          if (Test-Path -LiteralPath 'artifacts/proof/scale-smoke.txt') {
            $scaleBudgetLine = Select-String -Path 'artifacts/proof/scale-smoke.txt' -Pattern 'SCALE_PERFORMANCE_BUDGET_OK' | Select-Object -First 1
            if ($scaleBudgetLine) {
              $summaryLines.Add("- $($scaleBudgetLine.Line)")
            }
            $scaleLine = Select-String -Path 'artifacts/proof/scale-smoke.txt' -Pattern 'SCALE_HISTORY_CONTRACT_OK' | Select-Object -First 1
            if ($scaleLine) {
              $summaryLines.Add("- $($scaleLine.Line)")
            }
          }

          if (Test-Path -LiteralPath 'artifacts/coverage/release-summary.json') {
            $coverage = Get-Content 'artifacts/coverage/release-summary.json' -Raw | ConvertFrom-Json
            $summaryLines.Add("- COVERAGE_REPORT_OK:$($coverage.coveredLines):$($coverage.totalLines):$($coverage.lineRate)")
          }

          $summaryLines -join [Environment]::NewLine | Add-Content -LiteralPath $env:GITHUB_STEP_SUMMARY

      - name: Generate prerelease note body
        if: ${{ startsWith(github.ref, 'refs/tags/') }}
        shell: pwsh
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          $proofRoot = Join-Path $PWD 'artifacts/proof'
          $generatedNotesPath = Join-Path $proofRoot 'generated-release-notes.md'
          $prereleaseNotesPath = Join-Path $proofRoot 'prerelease-notes.md'
          $coverageSummaryPath = Join-Path $PWD 'artifacts/coverage/release-summary.json'

          gh api `
            -X POST `
            -H "Accept: application/vnd.github+json" `
            "/repos/$env:GITHUB_REPOSITORY/releases/generate-notes" `
            -f tag_name=$env:GITHUB_REF_NAME `
            --jq '.body' | Set-Content -LiteralPath $generatedNotesPath

          .\eng\write-prerelease-notes.ps1 `
            -RepoRoot $PWD `
            -ProofRoot $proofRoot `
            -OutputPath $prereleaseNotesPath `
            -CoverageSummaryPath $coverageSummaryPath `
            -PublicTag $env:GITHUB_REF_NAME `
            -GeneratedNotesPath $generatedNotesPath

  linux-validation:
    name: linux-validation
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_ref || github.ref }}

      - name: Prepare NuGet cache directory
        shell: pwsh
        run: New-Item -ItemType Directory -Force -Path $env:NUGET_PACKAGES | Out-Null

      - name: Setup .NET SDK
        uses: actions/setup-dotnet@v5
        with:
          global-json-file: global.json
          cache: true
          cache-dependency-path: |
            global.json
            Directory.Build.props
            NuGet.Config
            NuGet.config.sample
            **/*.csproj

      - name: Run Linux validation lane
        shell: pwsh
        run: ./eng/ci.ps1 -Lane all -Framework all -Configuration Release

  create-github-prerelease:
    name: create-github-prerelease
    runs-on: ubuntu-latest
    needs:
      - windows-release-validation
      - linux-validation
    if: ${{ startsWith(github.ref, 'refs/tags/') }}

    steps:
      - name: Download prerelease artifacts
        uses: actions/download-artifact@v5
        with:
          name: prerelease-artifacts
          path: prerelease-artifacts

      - name: Create GitHub prerelease
        uses: softprops/action-gh-release@v2
        with:
          prerelease: true
          name: AsterGraph ${{ github.ref_name }}
          body_path: prerelease-artifacts/proof/prerelease-notes.md
          files: |
            prerelease-artifacts/packages/*.nupkg
            prerelease-artifacts/packages/*.snupkg
            prerelease-artifacts/proof/*.txt
            prerelease-artifacts/coverage/*.json

  publish-nuget-prerelease:
    name: publish-nuget-prerelease
    runs-on: windows-latest
    needs:
      - windows-release-validation
      - linux-validation
    if: ${{ startsWith(github.ref, 'refs/tags/') || (github.event_name == 'workflow_dispatch' && inputs.publish_to_nuget) }}
    env:
      NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}

    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_ref || github.ref }}

      - name: Prepare NuGet cache directory
        shell: pwsh
        run: New-Item -ItemType Directory -Force -Path $env:NUGET_PACKAGES | Out-Null

      - name: Setup .NET SDK
        uses: actions/setup-dotnet@v5
        with:
          global-json-file: global.json

      - name: Download prerelease artifacts
        uses: actions/download-artifact@v5
        with:
          name: prerelease-artifacts
          path: prerelease-artifacts

      - name: Validate manual publish is limited to beta packages
        if: ${{ github.event_name == 'workflow_dispatch' && inputs.publish_to_nuget }}
        shell: pwsh
        run: |
          $packages = Get-ChildItem -Path 'prerelease-artifacts/packages' -Filter '*.nupkg' -File |
            Where-Object { $_.Name -notlike '*.snupkg' }

          if ($packages.Count -eq 0) {
            throw 'No prerelease packages were downloaded.'
          }

          $nonBetaPackages = $packages | Where-Object { $_.Name -notmatch '-beta' }
          if ($nonBetaPackages.Count -gt 0) {
            $names = $nonBetaPackages.Name -join ', '
            throw "Manual workflow publish is limited to beta packages. Non-beta packages: $names"
          }

      - name: Skip NuGet publish when no API key is configured
        if: ${{ env.NUGET_API_KEY == '' }}
        shell: pwsh
        run: Write-Host 'NUGET_API_KEY is not configured; skipping NuGet prerelease publish.'

      - name: Push NuGet prerelease packages
        if: ${{ env.NUGET_API_KEY != '' }}
        shell: pwsh
        run: |
          $packages = Get-ChildItem -Path 'prerelease-artifacts/packages' -Filter '*.nupkg' -File |
            Where-Object { $_.Name -notlike '*.snupkg' }

          if ($packages.Count -eq 0) {
            throw 'No prerelease packages were downloaded.'
          }

          foreach ($package in $packages) {
            dotnet nuget push $package.FullName `
              --api-key $env:NUGET_API_KEY `
              --source https://api.nuget.org/v3/index.json `
              --skip-duplicate
          }