# Bump the uv version and create a pull request.
name: "Prepare release"

on:
  workflow_dispatch:
    inputs:
      version:
        description: "The version to set (overrides detection)"
        required: false
        type: string

permissions: {}

jobs:
  prepare-release:
    if: github.repository == 'astral-sh/uv'
    runs-on: ubuntu-latest
    environment: automations
    permissions:
      contents: read
      id-token: write # for the credential broker
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
        with:
          version: "latest"
          enable-cache: true

      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
          save-if: false

      - name: "Get uv token"
        id: token
        uses: open-security-tools/ost-simple-sts@9e012247e07c39080fb6a832dbfbcfeacebc19c4
        with:
          exchange-url: ${{ secrets.STS_API_URL }}/exchange
          audience: ${{ secrets.STS_API_URL }}
          repository: astral-sh/uv
          permissions: |
            contents: write
            pull_requests: write

      - name: "Configure Git"
        run: |
          git config user.name "astral-automations-bot[bot]"
          git config user.email "305554984+astral-automations-bot[bot]@users.noreply.github.com"

      - name: "Bump version"
        run: |
          if [ -n "$INPUT_VERSION" ]; then
            ./scripts/release.sh --version "$INPUT_VERSION"
          else
            ./scripts/release.sh
          fi
        env:
          GITHUB_TOKEN: ${{ steps.token.outputs.token }}
          INPUT_VERSION: ${{ inputs.version }}
          INPUT_BUMP: ${{ inputs.bump }}

      - name: "Prepare Codex prompt"
        run: |
          {
            printf 'Release preparation for %s: Rewrite changelog\n\n' "$(uv version --short)"
            cat agents/prompts/editorialize-changelog.md
          } > "$RUNNER_TEMP/editorialize-changelog-prompt.md"

      - name: "Rewrite changelog"
        uses: openai/codex-action@52fe01ec70a42f454c9d2ebd47598f9fd6893d56 # v1
        with:
          openai-api-key: ${{ secrets.OPENAI_API_KEY }}
          model: gpt-5.6-sol
          permission-profile: ":read-only"
          safety-strategy: drop-sudo
          prompt-file: "${{ runner.temp }}/editorialize-changelog-prompt.md"
          output-file: "${{ runner.temp }}/changelog-section.md"

      - name: "Upload Codex thread"
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: codex-thread-release-prepare-${{ github.run_id }}-${{ github.run_attempt }}
          path: ~/.codex/sessions
          if-no-files-found: warn

      - name: "Apply changelog rewrite"
        run: |
          uv run scripts/update-latest-changelog-section.py \
            CHANGELOG.md \
            "$RUNNER_TEMP/changelog-section.md"

      - name: "Commit changelog rewrite"
        run: |
          git diff --check -- CHANGELOG.md
          if git diff --quiet -- CHANGELOG.md && git diff --cached --quiet -- CHANGELOG.md; then
            echo "Codex left the generated changelog unchanged."
          else
            git -c core.hooksPath=/dev/null commit --only --message "Rewrite changelog" -- CHANGELOG.md
          fi

      - name: "Create or update pull request"
        run: |
          branch="$(git branch --show-current)"
          git push --force \
            "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" \
            HEAD:"$branch"

          pull_request="$(
            gh pr list \
              --base main \
              --head "$branch" \
              --state open \
              --json url \
              --jq '.[0].url'
          )"
          if [ -n "$pull_request" ]; then
            printf '%s\n' "$pull_request"
          else
            gh pr create \
              --base main \
              --head "$branch" \
              --fill-first
          fi
        env:
          GITHUB_TOKEN: ${{ steps.token.outputs.token }}
