auto-tag.yml

name: auto-tag

# When a merge to main bumps packages/mcp/package.json version, push the
# corresponding release tag (mcp-v<ver>) AND dispatch release.yml on that tag.
# Idempotent: if the tag already exists, both steps no-op.
#
# Why we dispatch instead of relying on tag-push: GitHub suppresses workflow
# runs triggered by pushes made with GITHUB_TOKEN (anti-loop). Tag pushes from
# this job therefore do NOT fire release.yml on their own. workflow_dispatch
# is exempt from that rule, so we trigger release.yml explicitly.

on:
  push:
    branches: [main]
    paths:
      - "packages/mcp/package.json"
  workflow_dispatch:

permissions:
  contents: write
  actions: write   # required for `gh workflow run release.yml`

jobs:
  tag:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - package: mcp
            path: packages/mcp/package.json
            tag_prefix: mcp-v
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Read version
        id: ver
        run: |
          set -euo pipefail
          ver=$(node -p "require('./${{ matrix.path }}').version")
          tag="${{ matrix.tag_prefix }}${ver}"
          echo "tag=${tag}" >> "$GITHUB_OUTPUT"
          echo "version=${ver}" >> "$GITHUB_OUTPUT"
          echo "Resolved ${{ matrix.package }} version: ${ver} → tag ${tag}"

      - name: Skip if tag exists
        id: check
        run: |
          set -euo pipefail
          if git rev-parse --verify "refs/tags/${{ steps.ver.outputs.tag }}" >/dev/null 2>&1; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
            echo "Tag ${{ steps.ver.outputs.tag }} already exists locally."
          elif git ls-remote --exit-code --tags origin "refs/tags/${{ steps.ver.outputs.tag }}" >/dev/null 2>&1; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
            echo "Tag ${{ steps.ver.outputs.tag }} already exists on origin."
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Push tag
        if: steps.check.outputs.exists == 'false'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git tag "${{ steps.ver.outputs.tag }}" "${{ github.sha }}"
          git push origin "${{ steps.ver.outputs.tag }}"
          echo "Pushed ${{ steps.ver.outputs.tag }}."

      # GitHub suppresses workflow runs triggered by pushes made with
      # GITHUB_TOKEN (anti-loop). So a tag pushed above does NOT fire
      # release.yml on its own. workflow_dispatch IS exempt from that
      # rule, so dispatch release.yml explicitly.
      - name: Trigger release.yml
        if: steps.check.outputs.exists == 'false'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          gh workflow run release.yml \
            --ref "refs/tags/${{ steps.ver.outputs.tag }}" \
            -f package=${{ matrix.package }} \
            -f dry_run=false
          echo "Dispatched release.yml for ${{ steps.ver.outputs.tag }}."

      # Same GITHUB_TOKEN anti-loop suppression applies to build-image.yml — the
      # tag push above won't fire it on its own. Dispatch it explicitly so the
      # MCP container image is built for every auto-tagged release, in lock-step
      # with the npm publish.
      - name: Trigger build-image.yml
        if: steps.check.outputs.exists == 'false'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          gh workflow run build-image.yml \
            --ref "refs/tags/${{ steps.ver.outputs.tag }}"
          echo "Dispatched build-image.yml for ${{ steps.ver.outputs.tag }}."