n8n/.github/workflows/release-publish.yml

name: 'Release: Publish'

on:
  pull_request:
    types:
      - closed
    branches:
      - 'release/*'

jobs:
  build-arm64:
    runs-on: blacksmith-4vcpu-ubuntu-2204-arm
    if: github.event.pull_request.merged == true
    env:
      NODE_OPTIONS: --max-old-space-size=6144

    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Setup and Build ARM64
        uses: ./.github/actions/setup-nodejs
        env:
          N8N_FAIL_ON_POPULARITY_FETCH_ERROR: true

  determine-version-info:
    name: Determine publishing track
    runs-on: ubuntu-latest
    if: github.event.pull_request.merged == true
    outputs:
      track: ${{ steps.determine-info.outputs.track }}
      version: ${{ steps.determine-info.outputs.version }}
      bump: ${{ steps.determine-info.outputs.bump }}
      new_stable_version: ${{ steps.determine-info.outputs.new_stable_version }}
      release_type: ${{ steps.determine-info.outputs.release_type }}
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: ./.github/actions/setup-nodejs
        with:
          build-command: ''
          install-command: npm install --prefix=.github/scripts --no-package-lock

      - name: Determine track from package version number
        id: determine-info
        run: node .github/scripts/determine-version-info.mjs

  publish-to-npm:
    name: Publish to NPM
    needs: [determine-version-info]
    runs-on: ubuntu-latest
    if: github.event.pull_request.merged == true
    timeout-minutes: 20
    environment: npm
    permissions:
      id-token: write
    env:
      NPM_CONFIG_PROVENANCE: true
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Setup and Build
        uses: ./.github/actions/setup-nodejs
        env:
          N8N_FAIL_ON_POPULARITY_FETCH_ERROR: true
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}

      - name: Check for new unpublished packages
        run: node .github/scripts/detect-new-packages.mjs

      - name: Dry-run publishing
        run: |
          pnpm --filter n8n publish --no-git-checks --dry-run
          pnpm publish -r --filter '!n8n' --no-git-checks --dry-run          

      - name: Pre publishing changes
        run: |
          node .github/scripts/trim-fe-packageJson.js
          node .github/scripts/ensure-provenance-fields.mjs
          cp README.md packages/cli/README.md
          sed -i "s/default: 'dev'/default: '${{ needs.determine-version-info.outputs.release_type }}'/g" packages/cli/dist/config/schema.js          

      - name: Publish n8n to NPM with rc tag
        env:
          PUBLISH_BRANCH: ${{ github.event.pull_request.base.ref }}
        run: pnpm --filter n8n publish --publish-branch "$PUBLISH_BRANCH" --access public --tag rc --no-git-checks

      - name: Publish other packages to NPM with latest tag
        env:
          PUBLISH_BRANCH: ${{ github.event.pull_request.base.ref }}
        run: pnpm publish -r --filter '!n8n' --publish-branch "$PUBLISH_BRANCH" --access public --no-git-checks

      - name: Cleanup rc tag
        run: npm dist-tag rm n8n rc
        continue-on-error: true

  publish-to-docker-hub:
    name: Publish to DockerHub
    needs: [determine-version-info, publish-to-npm, build-arm64]
    uses: ./.github/workflows/docker-build-push.yml
    with:
      n8n_version: ${{ needs.determine-version-info.outputs.version }}
      release_type: ${{ needs.determine-version-info.outputs.release_type }}
    secrets: inherit

  create-github-release:
    name: Create a GitHub Release
    needs: [determine-version-info, publish-to-npm, publish-to-docker-hub]
    runs-on: ubuntu-latest
    if: github.event.pull_request.merged == true
    timeout-minutes: 5

    permissions:
      contents: write
      id-token: write

    steps:
      - name: Create a Release on GitHub
        uses: ncipollo/release-action@1c89adf39833729d8f85a31ccbc451b078733c80 # v1
        with:
          commit: ${{github.event.pull_request.base.ref}}
          tag: 'n8n@${{ needs.determine-version-info.outputs.version }}'
          prerelease: ${{ needs.determine-version-info.outputs.track == 'beta' }}
          makeLatest: ${{ needs.determine-version-info.outputs.track == 'stable' }}
          body: ${{github.event.pull_request.body}}

  move-track-tag:
    name: Move track tag
    needs: [determine-version-info, create-github-release]
    if: github.event.pull_request.merged == true
    uses: ./.github/workflows/release-update-pointer-tag.yml
    with:
      track: ${{ needs.determine-version-info.outputs.track }}
      version-tag: 'n8n@${{ needs.determine-version-info.outputs.version }}'
    secrets: inherit

  promote-stable-tag:
    name: Promote stable tag (minor bump)
    needs: [determine-version-info, create-github-release]
    if: |
      github.event.pull_request.merged == true &&
      needs.determine-version-info.outputs.new_stable_version != ''      
    uses: ./.github/workflows/release-update-pointer-tag.yml
    with:
      track: stable
      version-tag: 'n8n@${{ needs.determine-version-info.outputs.new_stable_version }}'
    secrets: inherit

  generate-and-attach-sbom:
    name: Generate and Attach SBOM to Release
    needs: [determine-version-info, create-github-release]
    uses: ./.github/workflows/sbom-generation-callable.yml
    with:
      n8n_version: ${{ needs.determine-version-info.outputs.version }}
      release_tag_ref: 'n8n@${{ needs.determine-version-info.outputs.version }}'
    secrets: inherit

  merge-release-tag-to-master:
    name: Merge release tag to master
    needs: [determine-version-info, publish-to-npm, create-github-release]
    if: |
      github.event.pull_request.merged == true &&
      needs.determine-version-info.outputs.bump == 'minor' &&
      needs.determine-version-info.outputs.release_type != 'rc'      
    runs-on: ubuntu-latest
    environment: minor-release-tag-merge
    env:
      VERSION: ${{ needs.determine-version-info.outputs.version }}
    steps:
      - name: Generate GitHub App Token
        id: generate_token
        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
        with:
          app-id: ${{ secrets.RELEASE_TAG_MERGE_APP_ID }}
          private-key: ${{ secrets.RELEASE_TAG_MERGE_PRIVATE_KEY }}
          skip-token-revoke: false

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: master
          fetch-depth: 500
          token: ${{ steps.generate_token.outputs.token }}

      - name: Verify release tag exists
        run: |
          if ! git ls-remote --tags origin "refs/tags/n8n@${VERSION}" | grep -q .; then
            echo "::error::Tag n8n@${VERSION} not found on remote"
            exit 1
          fi          

      - name: Fetch release tag
        run: git fetch origin "refs/tags/n8n@${VERSION}:refs/tags/n8n@${VERSION}"

      - name: Merge release tag to master
        run: |
          git config user.name "n8n-release-tag-merge[bot]"
          git config user.email "256767729+n8n-release-tag-merge[bot]@users.noreply.github.com"
          git merge --ff "n8n@${VERSION}"          

      - name: Push to master
        run: git push origin HEAD:master

      - name: Notify Slack on failure
        if: failure()
        uses: act10ns/slack@44541246747a30eb3102d87f7a4cc5471b0ffb7d # v2.1.0
        with:
          status: ${{ job.status }}
          channel: '#updates-and-product-releases'
          webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
          message: |
            <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}| Release tag merge to master failed for n8n@${{ needs.determine-version-info.outputs.version }} >            
  post-release:
    name: Run Post-release actions
    needs: [determine-version-info, publish-to-npm, create-github-release]
    uses: ./.github/workflows/release-publish-post-release.yml
    with:
      track: ${{ needs.determine-version-info.outputs.track }}
      version: ${{ needs.determine-version-info.outputs.version }}
      bump: ${{ needs.determine-version-info.outputs.bump }}
      new_stable_version: ${{ needs.determine-version-info.outputs.new_stable_version }}
      release_type: ${{ needs.determine-version-info.outputs.release_type }}
    secrets: inherit