release-modelparams.yml

name: Release modelparams

# Publishes the `modelparams` npm package when a release lands on main.
#
# Releases are batched: `release-prepare.yml` accumulates every catalog change
# since the last tag into one `chore: release …` PR that bumps
# packages/modelparams/package.json. That committed version is the trigger and
# the source of truth here — this workflow publishes it verbatim rather than
# recomputing a number. The bump level itself is still decided by the diff
# classifier (`findRemovedParams`, shared with `param-guard.yml`), just one step
# earlier, when the release PR is prepared:
#   • any param removed on a still-existing model → MAJOR
#   • any other catalog change                    → PATCH
#   • no semantic catalog change                  → no release PR
#
# `workflow_dispatch` republishes whatever version main currently declares — use
# it to recover from a failed publish, not to cut a new version.
#
# Auth: npm OIDC trusted publishing (no token). Requires npm >= 11.5.1, which
# ships with Node 24. Configure the trusted publisher for the `modelparams`
# package on npmjs.com (Settings → Trusted Publishers → GitHub Actions →
# org=mnfst, repo=modelparams.dev, workflow=release-modelparams.yml). Keep this
# job in this top-level workflow file: the trusted publisher is bound to this
# filename, so moving the publish step into a reusable workflow breaks OIDC.

on:
  push:
    branches: [main]
    paths:
      - "packages/modelparams/package.json"
  workflow_dispatch:

concurrency:
  group: release-modelparams
  cancel-in-progress: false

jobs:
  detect:
    name: Detect version bump
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.detect.outputs.version }}
    steps:
      - name: Check out repo
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Compare committed version against the push base
        id: detect
        env:
          BEFORE_SHA: ${{ github.event.before }}
          AFTER_SHA: ${{ github.sha }}
          MANUAL: ${{ github.event_name == 'workflow_dispatch' }}
        run: |
          # Read both versions from the immutable remote SHAs of the push event,
          # not from HEAD, so a multi-commit push is compared against what main
          # actually had before it. Publishing only on a *change* is what keeps
          # unrelated pushes that touch package.json (a dependency bump, a
          # description edit) from re-publishing an already-published version
          # and clobbering its tag and GitHub Release.
          CURR=$(git show "${AFTER_SHA}:packages/modelparams/package.json" | jq -r .version)
          if [ "$MANUAL" = "true" ]; then
            echo "version=$CURR" >> "$GITHUB_OUTPUT"
            echo "Manual dispatch: republishing $CURR"
            exit 0
          fi
          if [ -n "$BEFORE_SHA" ] && [ "$BEFORE_SHA" != "0000000000000000000000000000000000000000" ]; then
            PREV=$(git show "${BEFORE_SHA}:packages/modelparams/package.json" 2>/dev/null | jq -r .version 2>/dev/null || echo "")
          else
            PREV=""
          fi
          if [ -n "$PREV" ] && [ "$PREV" != "$CURR" ]; then
            echo "version=$CURR" >> "$GITHUB_OUTPUT"
            echo "Version bumped: $PREV -> $CURR"
          else
            echo "version=" >> "$GITHUB_OUTPUT"
            echo "::notice::No version change (PREV=${PREV:-<none>} CURR=${CURR}) — nothing to publish."
          fi

  publish:
    name: Build and publish
    needs: detect
    if: needs.detect.outputs.version != ''
    runs-on: ubuntu-latest
    permissions:
      contents: write # create release + tag
      id-token: write # npm OIDC provenance
    steps:
      - name: Check out repo
        uses: actions/checkout@v4

      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: "24" # npm >= 11.5.1 for OIDC trusted publishing
          cache: "npm"
          registry-url: "https://registry.npmjs.org"

      - name: Install dependencies
        run: npm ci

      - name: Validate catalog
        run: npm run validate

      - name: Typecheck (root)
        run: npm run typecheck

      - name: Codegen
        run: npm run codegen --workspace=modelparams

      - name: Build package
        run: npm run build --workspace=modelparams

      - name: Runtime tests
        run: npm test --workspace=modelparams

      - name: Type-level tests (tsd)
        run: npm run test:types --workspace=modelparams

      - name: Extract changelog entry
        id: notes
        env:
          VERSION: ${{ needs.detect.outputs.version }}
        run: |
          BODY=$(awk -v ver="## ${VERSION}" \
            '$0 == ver { found=1; next } found && /^## / { exit } found { print }' \
            packages/modelparams/CHANGELOG.md)
          {
            echo "body<<EOF_NOTES"
            echo "${BODY:-See the generated notes below.}"
            echo "EOF_NOTES"
          } >> "$GITHUB_OUTPUT"

      - name: Publish to npm
        run: npm publish --workspace=modelparams --provenance --access public

      # modelparams-mcp is NOT published here. The package has never existed on
      # npm, and npm cannot bootstrap a trusted publisher for a name that does
      # not exist yet — the first publish has to come from a logged-in account
      # (npm/cli#8544). Every attempt therefore failed with a misleading 404,
      # and because the publish step ran before the tagging steps below, each
      # failure also cost `modelparams` its release tag, which the version
      # classifier reads as the baseline for the next release. Agents reach the
      # same four tools at https://modelparams.dev/mcp, which ships with the
      # site. To restore this: publish the package once by hand, configure its
      # trusted publisher against THIS workflow file, then re-add the publish
      # step AFTER the tag steps.
      - name: Create GitHub release + tag
        uses: softprops/action-gh-release@v2
        with:
          tag_name: "modelparams@${{ needs.detect.outputs.version }}"
          name: "modelparams@${{ needs.detect.outputs.version }}"
          target_commitish: ${{ github.sha }}
          body: ${{ steps.notes.outputs.body }}
          generate_release_notes: true