name: Release a hotfix

on:
  workflow_dispatch:
    inputs:
      pr-number:
        description: "Which PR should be released?"
        required: true
      confirm:
        description: "Confirm that the PR is up to date with the last published release, with the specific additional changes that should be released as part of this hotfix and the relevant package patch versions bumped"
        type: boolean
        required: true
      label:
        description: "Which dist-tag should this release have?"
        type: string
        default: hotfix
        required: true

permissions:
  contents: read
  id-token: write

jobs:
  hotfix-release:
    name: Hotfix Release
    if: ${{ inputs.confirm == true }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Check user for team affiliation
        uses: tspascoal/get-user-teams-membership@ba78054988f58bea69b7c6136d563236f8ed2fc0 # v2
        id: teamAffiliation
        with:
          GITHUB_TOKEN: ${{ secrets.READ_ONLY_ORG_GITHUB_TOKEN }}
          username: ${{ github.actor }}
          team: wrangler

      - name: Stop workflow if user is not a wrangler team member
        if: ${{ steps.teamAffiliation.outputs.isTeamMember == false }}
        run: |
          echo "You must be on the "wrangler" team to trigger this job."
          exit 1

      - name: "Checkout PR"
        run: |
          if ! [[ "$PR_NUMBER" =~ ^[0-9]+$ ]]; then
            echo "::error::PR number must be numeric"
            exit 1
          fi
          gh pr checkout "$PR_NUMBER"
        env:
          GH_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
          PR_NUMBER: ${{ inputs.pr-number }}

      - name: Install Dependencies
        # Defense in depth: do not pass Turbo remote cache credentials and
        # disable the pnpm store cache so release builds always resolve
        # packages from the registry and rebuild every task from source,
        # rather than restoring from a (potentially poisoned) cache.
        uses: ./.github/actions/install-dependencies
        with:
          disable-cache: "true"

      - name: Build all packages
        run: pnpm run build
        env:
          CI_OS: ${{ runner.os }}

      - name: Publish packages
        run: |
          if ! [[ "$NPM_TAG" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]]; then
            echo "::error::npm dist-tag contains unsupported characters"
            exit 1
          fi
          pnpm publish -r --tag "$NPM_TAG" --filter wrangler --filter miniflare --filter create-cloudflare
        env:
          NPM_TAG: ${{ inputs.label }}