release.yml

name: 🚀 Release

on:
  workflow_dispatch:

permissions:
  id-token: write
  contents: write

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest

    steps:
      - name: Verify main branch
        run: |
          if [[ "${{ github.ref_name }}" != "main" ]]; then
            echo "Release can only be done on the main branch."
            exit 1
          fi

      - name: Checkout project
        uses: actions/checkout@v6

      - name: Install Mise
        uses: caido/action-mise-action@v3.2.0
        with:
          working_directory: .
          version: ${{ vars.CI__MISE_VERSION }}

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build package
        run: pnpm build

      - name: Sign package
        working-directory: dist
        run: |
          if [[ -z "${{ secrets.PRIVATE_KEY }}" ]]; then
            echo "Set an ed25519 key as PRIVATE_KEY in GitHub Action secret to sign."
            exit 1
          else
            echo "${{ secrets.PRIVATE_KEY }}" > private_key.pem
            openssl pkeyutl -sign -inkey private_key.pem -out plugin_package.zip.sig -rawin -in plugin_package.zip
            rm private_key.pem
          fi

      - name: Check version
        id: meta
        working-directory: dist
        run: |
          VERSION=$(unzip -p plugin_package.zip manifest.json | jq -r .version)
          echo "version=${VERSION}" >> $GITHUB_OUTPUT

      - name: Publish package
        working-directory: packages/shared
        run: |
          pnpm run build
          npm pkg set "version=${{ steps.meta.outputs.version }}"
          npm publish --access public --provenance

      - name: Create release
        uses: caido/action-release@v1
        with:
          tag: ${{ steps.meta.outputs.version }}
          commit: ${{ github.sha }}
          body: 'Release ${{ steps.meta.outputs.version }}'
          artifacts: 'dist/plugin_package.zip,dist/plugin_package.zip.sig'
          immutableCreate: true