release.yml

name: Release
'on':
  workflow_dispatch:
    inputs:
      bump:
        description: Version bump
        required: true
        type: choice
        options:
        - patch
        - minor
        - major
permissions:
  contents: read
concurrency: release-${{ github.repository }}
jobs:
  prepare:
    name: Prepare release
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    outputs:
      version: ${{ steps.release.outputs.version }}
      tag: ${{ steps.release.outputs.tag }}
    steps:
    - name: Check out source
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
      with:
        fetch-depth: 0
    - name: Set up development tools
      uses: nicodes/tools/setup@a1c0321f3b4917a7e99eca42e241e46670f6e1e1
      env:
        GH_TOKEN: ${{ github.token }}
      timeout-minutes: 5
    - name: Determine release version
      id: release
      env:
        BUMP: ${{ inputs.bump }}
      run: |-
        set -euo pipefail
        test "$GITHUB_REF" = refs/heads/main || { echo 'Run releases from main.' >&2; exit 1; }
        git fetch --tags --force
        latest="$(git tag --list 'v[0-9]*' | sed -E 's/^v//' | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' | sort -V | tail -n 1 || true)"
        if [ -z "$latest" ]; then
          version=0.0.1
        else
          IFS=. read -r major minor patch <<< "$latest"
          case "$BUMP" in
            major) major=$((major + 1)); minor=0; patch=0 ;;
            minor) minor=$((minor + 1)); patch=0 ;;
            patch) patch=$((patch + 1)) ;;
            *) exit 1 ;;
          esac
          version="$major.$minor.$patch"
        fi
        tag="v$version"
        if git rev-parse -q --verify "refs/tags/$tag" >/dev/null; then
          echo "Release tag $tag already exists." >&2
          exit 1
        fi
        plugin_version="$(sed -n -E 's/^version="([^"]+)"/\1/p' addon/plugin.cfg | head -n 1)"
        test "$plugin_version" = "$version" || { echo "plugin.cfg is $plugin_version; expected $version" >&2; exit 1; }
        echo "version=$version" >> "$GITHUB_OUTPUT"
        echo "tag=$tag" >> "$GITHUB_OUTPUT"
    - name: Check project
      shell: bash
      run: |-
        set -euo pipefail
        mise run check
    - name: Record tested artifact identity
      run: (cd dist && sha256sum @aviorstudio_gd-telemetry.zip > @aviorstudio_gd-telemetry.zip.sha256)
    - name: Upload artifacts
      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
      with:
        name: release-${{ steps.release.outputs.tag }}
        path: |
          dist/@aviorstudio_gd-telemetry.zip
          dist/@aviorstudio_gd-telemetry.zip.sha256
          dist/installed-tree.sha256
        if-no-files-found: error
    permissions:
      contents: read
      attestations: read
    env:
      MISE_GITHUB_TOKEN: ${{ github.token }}
  publish:
    name: Publish release
    needs: prepare
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: write
    steps:
    - name: Check out source
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
    - name: Download artifacts
      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
      with:
        name: release-${{ needs.prepare.outputs.tag }}
        path: dist
    - name: Verify tested bytes
      run: (cd dist && sha256sum --check @aviorstudio_gd-telemetry.zip.sha256)
    - name: Create GitHub release
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        TAG: ${{ needs.prepare.outputs.tag }}
      run: gh release create "$TAG" dist/@aviorstudio_gd-telemetry.zip dist/@aviorstudio_gd-telemetry.zip.sha256 dist/installed-tree.sha256
        --target "$GITHUB_SHA" --title "$TAG" --notes "Release $TAG from tested bytes"
    - name: Publish addon
      uses: aviorstudio/gdam-actions/publish@3a46007e296e60e15a4ad47727ad33046e52e6ea
      with:
        tag: ${{ needs.prepare.outputs.tag }}
        api-key: ${{ secrets.GDAM_API_KEY }}
        asset: '@aviorstudio_gd-telemetry.zip'