deploy-latest.yml

name: Deploy Latest
on:
  workflow_dispatch:
  push:
    branches: [main]
permissions:
  contents: write
  pull-requests: write
jobs:
  sync-dev-to-main:
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-22.04
    permissions:
      id-token: write
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4
        with:
          ref: main
          fetch-depth: 0
          token: ${{ secrets.ADMIN_TOKEN }}
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version-file: package.json
      - name: Sync dev to main
        run: |
          git config --global user.email "github-actions[bot]@users.noreply.github.com"
          git config --global user.name "github-actions[bot]"
          git rebase --autostash origin/dev
          git pull --rebase origin main
          npm install
          npm run build
          npm test
          git push origin main

  release-please:
    if: github.event_name != 'workflow_dispatch'
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    steps:
      - uses: googleapis/release-please-action@v4
        id: release
        with:
          token: ${{ secrets.ADMIN_TOKEN }}
          target-branch: main
      - name: Checkout Repository
        if: steps.release.outputs.releases_created == 'true'
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.ADMIN_TOKEN }}
      - name: Setup Node
        if: steps.release.outputs.releases_created == 'true'
        uses: actions/setup-node@v4
        with:
          node-version-file: package.json
          registry-url: "https://registry.npmjs.org"
      - name: Build Packages and Publish to NPM
        if: steps.release.outputs.releases_created == 'true'
        env:
          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
          NPM_CONFIG_PROVENANCE: true
          GH_TOKEN: ${{ secrets.ADMIN_TOKEN }}
        run: |
          npm install
          npm run build
          npm run util:update-3rd-party-licenses

          git config --global user.email "github-actions[bot]@users.noreply.github.com"
          git config --global user.name "github-actions[bot]"

          release_commit="$(git rev-parse HEAD)"

          # The "|| true" prevents failure if there are no changes
          git add package-lock.json || true
          git add **/THIRD-PARTY-LICENSES.md || true

          # The release-please PR only updates when there are new deployable
          # commits, e.g., fixes, features, or breaking changes. This is fine
          # but it means autogenerated files can become outdated.
          #
          # Lerna will only publish when the working tree is clean, so changes
          # to autogenerated files cause the release to fail.
          #
          # The workaround is to commit the files before releasing so everything
          # will be up to date in the dists. The commit will be discarded once
          # the container is destroyed, and then the autogenerated files will be
          # updated in a subsequent PR.
          git commit -m "build(deps): update package-lock" || true

          npm run publish:latest
          npm run util:upload-release-assets -- "${{toJSON(steps.release.outputs.paths_released)}}"

          git checkout -b ci/cherry-pick-release-commit origin/dev

          if ! git cherry-pick "$release_commit"; then
            git checkout --theirs \
              ${{github.workspace}}/packages/*/CHANGELOG.md

            git checkout --theirs \
              ${{github.workspace}}/packages/*/package.json

            git cherry-pick --continue
          fi

          git push -u origin HEAD
          gh pr create --fill --head "ci/cherry-pick-release-commit" --base "dev" \
            --label "skip visual snapshots"