SearXNG MCP Bridge

name: Release

on:
  push:
    branches:
      - master
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write
  issues: write
  id-token: write

concurrency:
  group: release-${{ github.ref_name }}
  cancel-in-progress: false

jobs:
  release-please:
    name: Prepare Release
    runs-on: ubuntu-latest
    outputs:
      release_created: ${{ steps.release.outputs.release_created }}
      tag_name: ${{ steps.release.outputs.tag_name }}
      version: ${{ steps.release.outputs.version }}

    steps:
      - name: Run release-please
        id: release
        uses: googleapis/release-please-action@v4
        with:
          token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
          config-file: release-please-config.json
          manifest-file: .release-please-manifest.json

      - name: Enable auto-merge for release PR
        if: ${{ steps.release.outputs.prs_created == 'true' }}
        env:
          GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
          GITHUB_REPOSITORY: ${{ github.repository }}
        run: |
          PRS='${{ steps.release.outputs.prs }}'

          if [ -z "$PRS" ] || [ "$PRS" = "[]" ]; then
            echo "No PRs found. Skipping auto-merge."
            exit 0
          fi

          PR_NUMBER=$(echo "$PRS" | jq -r '.[0].number')

          if [ -z "$PR_NUMBER" ] || [ "$PR_NUMBER" = "null" ]; then
            echo "Invalid PR number."
            exit 1
          fi

          echo "Enabling auto-merge for PR #$PR_NUMBER"
          gh pr merge --auto --squash --repo "$GITHUB_REPOSITORY" "$PR_NUMBER"

  publish:
    name: Publish Package
    needs: release-please
    if: ${{ needs.release-please.outputs.release_created == 'true' }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write

    env:
      RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
      RELEASE_VERSION: ${{ needs.release-please.outputs.version }}
      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

    steps:
      - name: Checkout release tag
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          ref: ${{ env.RELEASE_TAG }}

      - name: Use Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '22.x'
          registry-url: 'https://registry.npmjs.org'
          cache: 'npm'

      - name: Update npm
        run: npm i -g npm@11.5.1

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run build

      - name: Validate release version
        run: |
          VERSION="${RELEASE_VERSION}"
          if [[ -z "$VERSION" ]]; then
            VERSION="${RELEASE_TAG#v}"
          fi

          PKG_VERSION="$(node -p 'require("./package.json").version')"

          if [[ "$VERSION" != "$PKG_VERSION" ]]; then
            echo "::error::Release version ($VERSION) does not match package.json version ($PKG_VERSION)"
            exit 1
          fi

          echo "✅ Version consistency check passed"

      - name: Publish to npm with trusted publishing (OIDC)
        id: publish_with_oidc
        continue-on-error: true
        run: npm publish

      - name: Publish to npm with token fallback
        id: publish_with_token
        if: ${{ steps.publish_with_oidc.outcome == 'failure' && env.NPM_TOKEN != '' }}
        run: npm publish --provenance
        env:
          NODE_AUTH_TOKEN: ${{ env.NPM_TOKEN }}

      - name: Fail if publish did not succeed
        if: ${{ steps.publish_with_oidc.outcome == 'failure' && steps.publish_with_token.outcome != 'success' }}
        run: |
          echo "::error::npm publish failed. Configure trusted publishing (OIDC) or provide a valid granular NPM_TOKEN with write permissions."
          exit 1

      - name: Create package tarball
        run: npm pack

      - name: Upload package to GitHub release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh release upload "${RELEASE_TAG}" ./*.tgz --clobber