build-release.yml

name: Build and Release MCP Resources

on:
  pull_request:
    types: [closed]
    branches: [main]
  workflow_dispatch:
    inputs:
      version:
        description: 'Version number (e.g., 1.0.0)'
        required: false
        type: string

jobs:
  build-and-release:
    # Manual trigger OR (PR merged with label 'mcp-publish')
    if: |
      github.event_name == 'workflow_dispatch' ||
      (github.event.pull_request.merged == true && 
       contains(github.event.pull_request.labels.*.name, 'mcp-publish'))

    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0  # Fetch all history for proper versioning

      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 'lts/*'

      - name: Setup pnpm
        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
        with:
          version: latest

      - name: Install dependencies
        run: pnpm install

      - name: Determine version
        id: version
        env:
          INPUT_VERSION: ${{ github.event.inputs.version }}
          EVENT_NAME: ${{ github.event_name }}
          PR_LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }}
        run: |
          if [ -n "$INPUT_VERSION" ]; then
            VERSION="$INPUT_VERSION"
            echo "Using manually specified version: ${VERSION}"
          else
            # Get the latest semver tag (ignore 'latest' tag), or use 0.0.0 if no tags exist
            # Use grep to filter only tags matching semver pattern (v followed by digits)
            # Explicitly exclude 'latest' tag
            LATEST_TAG=$(git tag -l | grep -v '^latest$' | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | sort -V | tail -n 1)
            if [ -z "$LATEST_TAG" ]; then
              LATEST_TAG="v0.0.0"
            fi
            echo "Latest semver tag found: ${LATEST_TAG}"
            # Remove 'v' prefix if present
            LATEST_VERSION=${LATEST_TAG#v}

            # Parse version components
            IFS='.' read -r -a VERSION_PARTS <<< "$LATEST_VERSION"
            MAJOR=${VERSION_PARTS[0]:-0}
            MINOR=${VERSION_PARTS[1]:-0}
            PATCH=${VERSION_PARTS[2]:-0}

            # Determine bump type from PR labels
            BUMP_TYPE="patch"  # Default to patch
            if [ "$EVENT_NAME" == "pull_request" ]; then
              echo "PR Labels: ${PR_LABELS}"

              if echo "${PR_LABELS}" | grep -q "major"; then
                BUMP_TYPE="major"
              elif echo "${PR_LABELS}" | grep -q "minor"; then
                BUMP_TYPE="minor"
              elif echo "${PR_LABELS}" | grep -q "patch"; then
                BUMP_TYPE="patch"
              fi
            fi

            echo "Bump type: ${BUMP_TYPE}"

            # Increment version based on bump type
            case "${BUMP_TYPE}" in
              major)
                MAJOR=$((MAJOR + 1))
                MINOR=0
                PATCH=0
                ;;
              minor)
                MINOR=$((MINOR + 1))
                PATCH=0
                ;;
              patch)
                PATCH=$((PATCH + 1))
                ;;
            esac

            VERSION="${MAJOR}.${MINOR}.${PATCH}"
            echo "Bumping from ${LATEST_VERSION} to ${VERSION} (${BUMP_TYPE})"
          fi
          echo "version=${VERSION}" >> $GITHUB_OUTPUT
          echo "tag=v${VERSION}" >> $GITHUB_OUTPUT
          echo "Building version: ${VERSION}"

      - name: Build skills
        run: pnpm run build
        env:
          BUILD_VERSION: ${{ steps.version.outputs.version }}

      - name: Scan skills for prompt injection
        run: bash scripts/scan-prompt-injection.sh dist/skills

      - name: List build artifacts
        run: |
          echo "=== dist/ ==="
          ls -lh dist/
          echo "=== dist/skills/ ==="
          ls -lh dist/skills/

      - name: Create Release
        id: create_release
        uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: ${{ steps.version.outputs.tag }}
          release_name: Release ${{ steps.version.outputs.tag }}
          body: |
            Automated release of PostHog integration resources for AI agents.

            This release contains:
            - **skills-mcp-resources.zip** - Bundle containing skills manifest + all skill ZIPs
            - Individual skill ZIPs for direct download

            **Version:** ${{ steps.version.outputs.version }}
            **SHA:** ${{ github.sha }}
          draft: false
          prerelease: false

      - name: Upload skills bundle
        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ steps.create_release.outputs.upload_url }}
          asset_path: ./dist/skills-mcp-resources.zip
          asset_name: skills-mcp-resources.zip
          asset_content_type: application/zip

      - name: Upload individual skill ZIPs and skill menu
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_TAG: ${{ steps.version.outputs.tag }}
        run: |
          # Upload each skill ZIP as a release asset
          for file in dist/skills/*.zip; do
            filename=$(basename "$file")
            echo "Uploading $filename..."
            gh release upload "$RELEASE_TAG" "$file" --clobber
          done
          # Upload skill-menu.json (used by the wizard to discover available skills)
          echo "Uploading skill-menu.json..."
          gh release upload "$RELEASE_TAG" dist/skills/skill-menu.json --clobber
          # Upload reference docs (used by the wizard for runtime-specific overrides)
          for file in dist/skills/*.md; do
            [ -f "$file" ] || continue
            filename=$(basename "$file")
            echo "Uploading $filename..."
            gh release upload "$RELEASE_TAG" "$file" --clobber
          done

      - name: Update latest tag
        env:
          RELEASE_TAG: ${{ steps.version.outputs.tag }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          # Create the version tag locally first
          git tag "$RELEASE_TAG"
          # Point latest to the current commit (same as the version tag)
          git tag -f latest
          # Push both tags
          git push origin "$RELEASE_TAG"
          git push -f origin latest

      - name: Generate skills repo token
        id: skills_token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.SKILLS_PUSH_APP_ID }}
          private-key: ${{ secrets.SKILLS_PUSH_APP_PRIVATE_KEY }}
          repositories: skills

      - name: Push plugins to skills repo
        env:
          SKILLS_REPO_TOKEN: ${{ steps.skills_token.outputs.token }}
          RELEASE_VERSION: ${{ steps.version.outputs.version }}
        run: |
          MANIFEST="dist/push-manifest.json"
          TARGET_REPO=$(jq -r '.target_repo' "$MANIFEST")
          WORK_DIR=$(mktemp -d)

          echo "Cloning $TARGET_REPO..."
          git clone "https://x-access-token:${SKILLS_REPO_TOKEN}@github.com/${TARGET_REPO}.git" "$WORK_DIR"

          # Read each plugin entry from the push manifest and sync to the destination
          jq -c '.plugins[]' "$MANIFEST" | while read -r entry; do
            NAME=$(echo "$entry" | jq -r '.name')
            SOURCE="dist/$(echo "$entry" | jq -r '.source')"
            DEST="$WORK_DIR/$(echo "$entry" | jq -r '.destination')"

            echo "  Syncing $NAME → $(echo "$entry" | jq -r '.destination')"

            # Clear destination (preserve README.md if present)
            if [ -d "$DEST" ]; then
              find "$DEST" -mindepth 1 -not -name 'README.md' -not -name '.' -exec rm -rf {} + 2>/dev/null || true
            fi
            mkdir -p "$DEST"

            # Copy plugin contents
            cp -r "$SOURCE"/. "$DEST"/
          done

          # Commit and push
          cd "$WORK_DIR"
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add -A
          if git diff --cached --quiet; then
            echo "No changes to push"
          else
            git commit -m "Update generated plugins from context-mill v${RELEASE_VERSION}"
            git push
            echo "Pushed updated plugins to $TARGET_REPO"
          fi
          rm -rf "$WORK_DIR"

      - name: Build Summary
        env:
          RELEASE_VERSION: ${{ steps.version.outputs.version }}
          RELEASE_TAG: ${{ steps.version.outputs.tag }}
        run: |
          echo "## Release Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "- **Version:** $RELEASE_VERSION" >> $GITHUB_STEP_SUMMARY
          echo "- **Tag:** $RELEASE_TAG" >> $GITHUB_STEP_SUMMARY
          echo "- **Bundle:** skills-mcp-resources.zip" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Skills Manifest" >> $GITHUB_STEP_SUMMARY
          echo '```json' >> $GITHUB_STEP_SUMMARY
          cat dist/skills/manifest.json | jq '{version, buildVersion, buildTimestamp, skillCount: (.skills | length)}' >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Individual Skills" >> $GITHUB_STEP_SUMMARY
          ls -lh dist/skills/*.zip >> $GITHUB_STEP_SUMMARY