name: Publish

on:
  workflow_dispatch:
    inputs:
      package:
        description: "Which package set to publish"
        required: true
        type: choice
        options:
          - bailian-cli
          - knowledge-studio-cli
          - bailian-kb-dsh
      mode:
        description: "Publish mode"
        required: true
        type: choice
        options:
          - channel
          - stable
      channel:
        description: "Required when mode=channel. npm dist-tag only (lowercase, digits, dashes), e.g. mcp / plugin / sync-release. bailian-cli binary CDN always overwrites sync-release.json; knowledge-studio-cli and bailian-kb-dsh are npm-only."
        required: false
        type: string

concurrency:
  group: publish-${{ inputs.package }}-${{ inputs.mode }}-${{ inputs.channel }}
  cancel-in-progress: false

jobs:
  publish-stable:
    if: inputs.mode == 'stable' && inputs.package != 'bailian-kb-dsh'
    name: publish stable (${{ inputs.package }}) to npm + binary + tag
    runs-on: ubuntu-latest
    environment: production # Required Reviewers gate
    permissions:
      contents: write # push tag + create GitHub Release with binary assets
      id-token: write # OIDC for npm Trusted Publishing + provenance
    steps:
      - uses: actions/checkout@v6

      - uses: pnpm/action-setup@v6

      - uses: actions/setup-node@v6
        with:
          node-version: "24"
          cache: pnpm
          registry-url: "https://registry.npmjs.org/"

      - name: Install gitleaks
        run: |
          set -euo pipefail
          GITLEAKS_VERSION=8.21.2
          curl -sSfL \
            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
            | sudo tar -xz -C /usr/local/bin gitleaks
          gitleaks version

      - name: Ensure zip (per-platform binary archives)
        run: sudo apt-get update && sudo apt-get install -y zip

      - run: pnpm install --frozen-lockfile

      # Binary compile uses `bun build --compile` CLI (not Bun.build API).
      # Keep this pin in sync with any local smoke tests of binary-compile.mjs.
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.2.19"

      - name: publish-stable
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # OSS release channel runs fully in CI: upload + reconcile + manifest.json.
          # All values come from repo Settings → Secrets — no OSS defaults live in
          # code. Leave AK/SK unset to skip the OSS channel; once enabled,
          # bucket/region/prefix are required.
          BAILIAN_OSS_AK: ${{ secrets.BAILIAN_OSS_AK }}
          BAILIAN_OSS_SK: ${{ secrets.BAILIAN_OSS_SK }}
          BAILIAN_OSS_BUCKET: ${{ secrets.BAILIAN_OSS_BUCKET }}
          BAILIAN_OSS_REGION: ${{ secrets.BAILIAN_OSS_REGION }}
          BAILIAN_OSS_ENDPOINT: ${{ secrets.BAILIAN_OSS_ENDPOINT }}
          BAILIAN_RELEASE_PREFIX: ${{ secrets.BAILIAN_RELEASE_PREFIX }}
          BAILIAN_STATIC_PREFIX: ${{ secrets.BAILIAN_STATIC_PREFIX }}
        run: node tools/release/publish-stable.mjs ${{ inputs.package == 'knowledge-studio-cli' && '--knowledge' || '' }}

  publish-channel:
    if: inputs.mode == 'channel' && inputs.package != 'bailian-kb-dsh'
    name: publish channel (${{ inputs.package }}) to npm + binary
    runs-on: ubuntu-latest
    permissions:
      contents: write # create prerelease GitHub Release with binary assets
      id-token: write # OIDC for npm Trusted Publishing + provenance
    steps:
      - name: Require channel input
        if: ${{ inputs.channel == '' }}
        run: |
          echo "::error::mode=channel requires the workflow input \"channel\" (npm dist-tag, e.g. mcp / plugin / sync-release). Leave mode=stable if you do not need a dist-tag."
          exit 1

      - uses: actions/checkout@v6

      - uses: pnpm/action-setup@v6

      - uses: actions/setup-node@v6
        with:
          node-version: "24"
          cache: pnpm
          registry-url: "https://registry.npmjs.org/"

      - name: Install gitleaks
        run: |
          set -euo pipefail
          GITLEAKS_VERSION=8.21.2
          curl -sSfL \
            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
            | sudo tar -xz -C /usr/local/bin gitleaks
          gitleaks version

      - name: Ensure zip (per-platform binary archives)
        run: sudo apt-get update && sudo apt-get install -y zip

      - run: pnpm install --frozen-lockfile

      # Binary compile uses `bun build --compile` CLI (not Bun.build API).
      # Keep this pin in sync with any local smoke tests of binary-compile.mjs.
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.2.19"

      - name: publish-channel
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # OSS release channel — same Settings-injected values as stable.
          BAILIAN_OSS_AK: ${{ secrets.BAILIAN_OSS_AK }}
          BAILIAN_OSS_SK: ${{ secrets.BAILIAN_OSS_SK }}
          BAILIAN_OSS_BUCKET: ${{ secrets.BAILIAN_OSS_BUCKET }}
          BAILIAN_OSS_REGION: ${{ secrets.BAILIAN_OSS_REGION }}
          BAILIAN_OSS_ENDPOINT: ${{ secrets.BAILIAN_OSS_ENDPOINT }}
          BAILIAN_RELEASE_PREFIX: ${{ secrets.BAILIAN_RELEASE_PREFIX }}
          BAILIAN_STATIC_PREFIX: ${{ secrets.BAILIAN_STATIC_PREFIX }}
        run: node tools/release/publish-channel.mjs ${{ inputs.package == 'knowledge-studio-cli' && '--knowledge' || '' }} --channel "${{ inputs.channel }}"

  # bailian-kb-dsh is the dsh plugin (downstream host adapter): independent version,
  # tsc + tsdown build, npm-only. It shares this workflow's entry UI and setup steps
  # but NOT publish-stable.mjs / publish-channel.mjs — those broadcast one version
  # across the locked bl package set and produce binary artifacts, neither of which
  # applies here. See docs/agents/dsh-plugin.md.
  publish-kb-dsh:
    if: inputs.package == 'bailian-kb-dsh'
    name: publish ${{ inputs.mode }} (bailian-kb-dsh) to npm
    runs-on: ubuntu-latest
    # stable goes through the Required Reviewers gate, same as the bl stable job;
    # channel stays ungated so dist-tag drops need no approval.
    environment: ${{ inputs.mode == 'stable' && 'production' || '' }}
    permissions:
      contents: write # push the bailian-kb-dsh-v<version> tag (stable only)
      id-token: write # OIDC for npm Trusted Publishing + provenance
    steps:
      - name: Require channel input
        if: ${{ inputs.mode == 'channel' && inputs.channel == '' }}
        run: |
          echo "::error::mode=channel requires the workflow input \"channel\" (npm dist-tag, e.g. mcp / plugin). Leave mode=stable if you do not need a dist-tag."
          exit 1

      - uses: actions/checkout@v6

      - uses: pnpm/action-setup@v6

      - uses: actions/setup-node@v6
        with:
          node-version: "24"
          cache: pnpm
          registry-url: "https://registry.npmjs.org/"

      - name: Install gitleaks
        run: |
          set -euo pipefail
          GITLEAKS_VERSION=8.21.2
          curl -sSfL \
            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
            | sudo tar -xz -C /usr/local/bin gitleaks
          gitleaks version

      - run: pnpm install --frozen-lockfile

      - name: publish-kb-dsh
        run: node tools/release/publish-kb-dsh.mjs ${{ inputs.mode == 'channel' && format('--channel "{0}"', inputs.channel) || '' }}