publish.yml

name: Publish Package to npmjs
on:
  release:
    types: [published]

env:
  RELEASE_VERSION: ${{ github.event.release.tag_name || github.ref_name }}

permissions:
  id-token: write  # Required for OIDC
  contents: read

jobs:
  check_changes:
    runs-on: ubuntu-latest
    outputs:
      harmony_changed: ${{ steps.check.outputs.changed }}
      prev_tag: ${{ steps.check.outputs.prev_tag }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Check Harmony changes
        id: check
        shell: bash
        run: |
          PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
          echo "prev_tag=$PREV_TAG" >> $GITHUB_OUTPUT
          if [ -z "$PREV_TAG" ]; then
            echo "No previous tag found, assuming harmony changed."
            echo "changed=true" >> $GITHUB_OUTPUT
            exit 0
          fi
          echo "Previous tag is $PREV_TAG"
          if git diff --name-only "$PREV_TAG" HEAD | grep -q '^harmony/'; then
            echo "harmony directory changed."
            echo "changed=true" >> $GITHUB_OUTPUT
          else
            echo "harmony directory has NO changes."
            echo "changed=false" >> $GITHUB_OUTPUT
          fi

  # Rebuild the Android native libraries from source so the published package
  # can never ship a stale librnupdate.so after a cpp/patch_core change (the
  # committed binaries are for local dev / git installs only).
  build_android_so:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      # Keep in sync with PINNED_NDK_VERSION in scripts/build-android-so.sh.
      NDK_VERSION: 28.2.13676358
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: recursive
      - name: Install pinned NDK
        run: echo "y" | "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" "ndk;$NDK_VERSION"
      - name: Build and verify native libraries
        # The runner image presets ANDROID_NDK_HOME/ANDROID_NDK_ROOT to its
        # bundled NDK, which would win over the pinned install in the script's
        # resolution order — force the pinned one so published .so files don't
        # drift with runner image upgrades.
        run: ANDROID_NDK_HOME="$ANDROID_HOME/ndk/$NDK_VERSION" bash scripts/build-android-so.sh
      - uses: actions/upload-artifact@v7
        with:
          name: android-so
          path: android/lib/
          if-no-files-found: error

  publish_with_harmony:
    needs: [check_changes, build_android_so]
    if: needs.check_changes.outputs.harmony_changed == 'true'
    runs-on: ubuntu-latest
    container: ghcr.io/sanchuanhehe/harmony-next-pipeline-docker/harmonyos-ci-image:latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: recursive
      - name: Configure git safe.directory
        run: |
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          git submodule foreach --recursive 'git config --global --add safe.directory "$toplevel/$sm_path"'
      - uses: oven-sh/setup-bun@v2
      # Setup .npmrc file to publish to npm
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          registry-url: 'https://registry.npmjs.org'
      - run: bun install --frozen-lockfile
      # Drop the committed binaries first: the artifact must fully replace
      # android/lib, so any layout regression makes the verify step fail loudly
      # instead of silently passing against stale committed .so files.
      - name: Remove committed Android native libraries
        run: rm -rf android/lib
      - name: Use CI-built Android native libraries
        uses: actions/download-artifact@v8
        with:
          name: android-so
          path: android/lib
      - name: Verify Android native libraries
        run: node scripts/verify-android-so.js
      - name: Build Harmony HAR
        run: npm run build:harmony-har -- --build-mode release
      - name: Verify Harmony HAR artifact
        run: test -f harmony/pushy.har
      - name: Publish to npm
        shell: bash
        run: |
          if [[ "${{ github.event.release.tag_name }}" == *"beta"* ]]; then
            npm publish --provenance --access public --tag beta
          else
            npm publish --provenance --access public
          fi

  publish_without_harmony:
    needs: [check_changes, build_android_so]
    if: needs.check_changes.outputs.harmony_changed == 'false'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: recursive
      - name: Configure git safe.directory
        run: |
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          git submodule foreach --recursive 'git config --global --add safe.directory "$toplevel/$sm_path"'
      - uses: oven-sh/setup-bun@v2
      # Setup .npmrc file to publish to npm
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          registry-url: 'https://registry.npmjs.org'
      - run: bun install --frozen-lockfile
      # Drop the committed binaries first: the artifact must fully replace
      # android/lib, so any layout regression makes the verify step fail loudly
      # instead of silently passing against stale committed .so files.
      - name: Remove committed Android native libraries
        run: rm -rf android/lib
      - name: Use CI-built Android native libraries
        uses: actions/download-artifact@v8
        with:
          name: android-so
          path: android/lib
      - name: Verify Android native libraries
        run: node scripts/verify-android-so.js
      # Fail closed: the package must always ship harmony/pushy.har
      # (.npmignore explicitly whitelists it). If the previous release can't
      # be fetched, fix the cause or re-run — never publish a HAR-less package.
      - name: Fetch previous Harmony HAR
        shell: bash
        run: |
          PREV_VERSION="${{ needs.check_changes.outputs.prev_tag }}"
          PREV_VERSION="${PREV_VERSION#v}"
          echo "Fetching harmony/pushy.har from react-native-update@$PREV_VERSION"
          npm pack "react-native-update@$PREV_VERSION"
          tar -xzf "react-native-update-${PREV_VERSION}.tgz" package/harmony/pushy.har
          mkdir -p harmony
          cp package/harmony/pushy.har harmony/pushy.har
          # Clean up temporary pack and extraction files to prevent publishing them
          rm -rf "react-native-update-${PREV_VERSION}.tgz" package
      - name: Verify Harmony HAR artifact
        run: test -f harmony/pushy.har
      - name: Publish to npm
        shell: bash
        run: |
          if [[ "${{ github.event.release.tag_name }}" == *"beta"* ]]; then
            npm publish --provenance --access public --tag beta
          else
            npm publish --provenance --access public
          fi