orca/.github/workflows/release-rc.yml

name: Schedule RC Release

on:
  workflow_dispatch:
    inputs:
      dry_run:
        description: Validate the workflow without creating an RC version or tag
        required: false
        default: false
        type: boolean
  schedule:
    # Why: GitHub scheduled workflows are not guaranteed to start exactly on
    # time and can be delayed or dropped around high-load periods. We retry
    # across the full target hour and dedupe per PT slot.
    - cron: '*/5 3,15 * * *'
      timezone: 'America/Los_Angeles'

permissions:
  contents: write

concurrency:
  group: release-rc
  cancel-in-progress: false

jobs:
  create-rc-tag:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    outputs:
      tag: ${{ steps.version.outputs.tag }}
      should_release: ${{ steps.window.outputs.allowed == 'true' && steps.existing.outputs.already_ran != 'true' && !(github.event_name == 'workflow_dispatch' && inputs.dry_run) }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: main
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24

      - name: Configure git author
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"          

      - name: Sync with latest main
        run: |
          git fetch origin main --tags
          git checkout main
          git reset --hard origin/main          

      - name: Compute RC slot
        id: slot
        run: |
          slot=$(TZ=America/Los_Angeles date '+%Y-%m-%d-%H')
          echo "value=$slot" >>"$GITHUB_OUTPUT"          

      - name: Validate PT release window
        id: window
        env:
          EVENT_NAME: ${{ github.event_name }}
        run: |
          if [[ "$EVENT_NAME" == "workflow_dispatch" ]]; then
            echo "allowed=true" >>"$GITHUB_OUTPUT"
            echo "reason=manual" >>"$GITHUB_OUTPUT"
            exit 0
          fi

          pt_hour=$(TZ=America/Los_Angeles date '+%H')
          pt_minute=$(TZ=America/Los_Angeles date '+%M')

          # Why: GitHub may deliver a scheduled event long after the intended
          # time. We only allow scheduled RC releases during the exact target
          # PT hours so a delayed run at 4:16 AM never creates a release that
          # was intended for 3:00 AM.
          if [[ "$pt_hour" == "03" || "$pt_hour" == "15" ]]; then
            echo "allowed=true" >>"$GITHUB_OUTPUT"
            echo "reason=target_hour:${pt_hour}:${pt_minute}" >>"$GITHUB_OUTPUT"
            exit 0
          fi

          echo "allowed=false" >>"$GITHUB_OUTPUT"
          echo "reason=outside_target_hour:${pt_hour}:${pt_minute}" >>"$GITHUB_OUTPUT"          

      - name: Skip if this PT release window already ran
        id: existing
        if: steps.window.outputs.allowed == 'true'
        run: |
          # Why: GitHub can delay or drop schedule events, especially near the
          # start of the hour. We schedule multiple attempts inside each target
          # PT hour and make the release idempotent per hour by embedding a
          # slot marker in the release commit message.
          if git log origin/main --grep="\\[rc-slot:${{ steps.slot.outputs.value }}\\]" -n 1 --format=%H | grep -q .; then
            echo "already_ran=true" >>"$GITHUB_OUTPUT"
            exit 0
          fi

          # Why: the first scheduled run today used the earlier workflow before
          # slot markers existed. Keep a tag-time fallback so retries in the
          # same PT hour still skip if an RC tag was already created.
          latest_rc_tag="$(git for-each-ref --sort=-creatordate --format='%(refname:short) %(creatordate:iso-strict)' 'refs/tags/v*-rc.*' | head -n 1)"
          if [[ -n "$latest_rc_tag" ]]; then
            latest_rc_tag_name="${latest_rc_tag%% *}"
            latest_rc_tag_date="${latest_rc_tag#* }"
            latest_rc_slot="$(TZ=America/Los_Angeles date -d "$latest_rc_tag_date" '+%Y-%m-%d-%H')"

            if [[ "$latest_rc_slot" == "${{ steps.slot.outputs.value }}" ]]; then
              echo "already_ran=true" >>"$GITHUB_OUTPUT"
              echo "reason=latest_rc_tag:$latest_rc_tag_name" >>"$GITHUB_OUTPUT"
              exit 0
            fi
          fi

          echo "already_ran=false" >>"$GITHUB_OUTPUT"          

      - name: Dry run summary
        if: github.event_name == 'workflow_dispatch' && inputs.dry_run
        run: |
          echo "Dry run only."
          echo "Current PT slot: ${{ steps.slot.outputs.value }}"
          echo "Window allowed: ${{ steps.window.outputs.allowed }}"
          echo "Window reason: ${{ steps.window.outputs.reason }}"
          echo "Already ran this slot: ${{ steps.existing.outputs.already_ran }}"
          echo "Reason: ${{ steps.existing.outputs.reason }}"          

      - name: Skip summary
        if: steps.window.outputs.allowed != 'true'
        run: |
          echo "Skipping scheduled RC release."
          echo "Current PT slot: ${{ steps.slot.outputs.value }}"
          echo "Reason: ${{ steps.window.outputs.reason }}"          

      - name: Create and push RC tag
        id: version
        if: steps.window.outputs.allowed == 'true' && steps.existing.outputs.already_ran != 'true' && !(github.event_name == 'workflow_dispatch' && inputs.dry_run)
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Why: pushes made with GITHUB_TOKEN do not reliably trigger other
          # workflows via push events. The RC workflow invokes release.yml
          # directly after creating the tag, so the actual Electron release
          # runs inside this scheduled flow instead of depending on push.
          new_tag="$(npm version prerelease --preid=rc -m "release: %s [rc-slot:${{ steps.slot.outputs.value }}]")"
          git push origin main --follow-tags
          echo "tag=$new_tag" >>"$GITHUB_OUTPUT"          

  release-rc:
    needs: create-rc-tag
    if: needs.create-rc-tag.outputs.should_release == 'true'
    uses: ./.github/workflows/release.yml
    with:
      tag: ${{ needs.create-rc-tag.outputs.tag }}
    secrets: inherit