release.yml

name: Release

on:
  push:
    tags:
      - v*.*.*
  workflow_dispatch:
    inputs:
      tag:
        description: Existing version tag to release, e.g. v0.0.225
        required: false
        type: string

permissions:
  contents: read

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  preflight:
    runs-on: ubuntu-24.04
    outputs:
      tag: ${{ steps.meta.outputs.tag }}
      prerelease: ${{ steps.meta.outputs.prerelease }}
      release_ref: ${{ steps.meta.outputs.release_ref }}
      release_sha: ${{ steps.meta.outputs.release_sha }}

    steps:
      - name: Check out repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
        with:
          fetch-depth: 0

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
        with:
          node-version-file: .nvmrc
          cache: npm
          cache-dependency-path: package-lock.json

      - name: Cache upstream parity clone
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae
        with:
          path: .tools/upstream-todo-tree
          key: upstream-todo-tree-7761bd02406a5c5f5bc8da944a561eb3c12a48df

      - name: Install dependencies
        run: npm ci

      - name: Resolve release metadata
        id: meta
        env:
          INPUT_TAG: ${{ inputs.tag }}
          REF_NAME: ${{ github.ref_name }}
          REF_TYPE: ${{ github.ref_type }}
        run: bash scripts/release/resolve-release-metadata.sh

      - name: Run release test suite
        run: npm test

      - name: Build release bundle
        run: npm run vscode:prepublish

  build:
    needs: preflight
    uses: ./.github/workflows/reusable-build-vsix.yml
    with:
      ref: ${{ needs.preflight.outputs.release_ref }}
      release_tag: ${{ needs.preflight.outputs.tag }}
      targets: '["win32-x64","win32-arm64","linux-x64","linux-arm64","linux-armhf","darwin-x64","darwin-arm64","alpine-x64","alpine-arm64","web"]'
    secrets: inherit

  publish:
    needs:
      - preflight
      - build
    runs-on: ubuntu-24.04
    environment: release
    permissions:
      contents: read
      id-token: write
      attestations: write

    steps:
      - name: Check out repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
        with:
          ref: ${{ needs.preflight.outputs.release_ref }}

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
        with:
          node-version-file: .nvmrc
          cache: npm
          cache-dependency-path: package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Download VSIX artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          pattern: vsix-*
          path: artifacts/release
          merge-multiple: true

      - name: Publish to VS Code Marketplace
        id: publish_vscode_marketplace
        env:
          VSCE_PAT: ${{ secrets.VSCE_PAT }}
        run: bash scripts/release/publish-vscode-marketplace.sh

      - name: Publish to Open VSX
        id: publish_open_vsx
        timeout-minutes: 4320
        env:
          OVSX_PAT: ${{ secrets.OVSX_PAT }}
          OPEN_VSX_RETRY_INTERVAL_SECONDS: 300
        run: bash scripts/release/publish-open-vsx.sh

      - name: Attest build provenance
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32
        with:
          subject-path: artifacts/release/*.vsix

      - name: Record registry publication outcomes
        if: always()
        run: |
          {
            echo '## Registry publication'
            echo "- VS Code Marketplace: ${{ steps.publish_vscode_marketplace.outcome }}"
            echo "- Open VSX: ${{ steps.publish_open_vsx.outcome }}"
          } >> "$GITHUB_STEP_SUMMARY"

          if [[ "${{ steps.publish_open_vsx.outcome }}" == 'failure' ]]; then
            echo '::warning::Open VSX publication failed after VS Code Marketplace publication completed.'
          fi

  github-release:
    needs:
      - preflight
      - publish
    runs-on: ubuntu-24.04
    permissions:
      contents: write

    steps:
      - name: Check out repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
        with:
          fetch-depth: 0
          ref: ${{ needs.preflight.outputs.release_ref }}

      - name: Download VSIX artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          pattern: vsix-*
          path: artifacts/release
          merge-multiple: true

      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ needs.preflight.outputs.tag }}
          PRERELEASE: ${{ needs.preflight.outputs.prerelease }}
          RELEASE_TARGET_SHA: ${{ needs.preflight.outputs.release_sha }}
        run: bash scripts/release/create-github-release.sh

  verify-marketplace:
    needs:
      - preflight
      - publish
      - github-release
    runs-on: ubuntu-24.04
    permissions:
      contents: read

    steps:
      - name: Check out repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
        with:
          fetch-depth: 0
          ref: ${{ needs.preflight.outputs.release_ref }}

      - name: Verify public VS Code Marketplace publication
        env:
          RELEASE_TAG: ${{ needs.preflight.outputs.tag }}
        run: bash scripts/release/verify-vscode-marketplace.sh