release.yml

name: Release

# A release: CI on the commit (which builds the backend's ok-image bundle, its universal package with
# every system's okrun, and both editor packages carrying the bundle), then a GitHub release of what
# the tag publishes, with its checksums. Open VSX and JetBrains consume the exact published archives
# independently after that release exists.
#
# WHAT A TAG PUBLISHES (design 2026-11-07, D15; .github/scripts/release-plan.sh): a version is X.Y.Z,
# X.Y the series every component shares and Z an editor plugin's own patch. The backend is always
# X.Y.0: the VS Code and CLion packages carry it, so a change of it is a series release.
#
#   vX.Y.0              a series release: the backend's ok-image bundle and package (xim's mcpp-ide),
#                       the VS Code extension, the CLion plugin and the Neovim plugin (a source tree,
#                       which xim takes from the tag's archive)
#   vscode-vX.Y.Z       the VSIX (Open VSX)
#   clion-vX.Y.Z        the CLion ZIP (JetBrains Marketplace)
#   nvim-vX.Y.Z         the Neovim plugin: the tag's source archive (xim's mcpp-ide-nvim)
#
# The tag's version must be the component's own, and every component one series.

on:
  workflow_dispatch:
  push:
    tags: ['v*', 'vscode-v*', 'clion-v*', 'nvim-v*']

permissions:
  contents: read

jobs:
  plan:
    runs-on: ubuntu-24.04
    outputs:
      components: ${{ steps.plan.outputs.components }}
      version: ${{ steps.plan.outputs.version }}
      title: ${{ steps.plan.outputs.title }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0   # a plugin's patch is checked against its series' tag
      - id: plan
        shell: bash   # -eo pipefail: a refused tag fails the step through tee
        run: bash .github/scripts/release-plan.sh "$GITHUB_REF_NAME" | tee -a "$GITHUB_OUTPUT"

  ci:
    needs: plan
    uses: ./.github/workflows/ci.yml
    # ci.yml's jobs read other runs' artifacts (a plugin borrows the backend main built); a called
    # workflow's jobs are granted no more than its caller's job, so this one grants that read.
    permissions:
      contents: read
      actions: read

  release:
    needs: [plan, ci]
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    env:
      COMPONENTS: ${{ needs.plan.outputs.components }}
      VERSION: ${{ needs.plan.outputs.version }}
      TITLE: ${{ needs.plan.outputs.title }}
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@v5
      - uses: actions/download-artifact@v5
        with:
          path: artifacts
      - name: Release
        id: publish
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          mkdir -p dist
          backend="$(sed -n 's/^version *= *"\(.*\)"/\1/p' mcpp.toml | head -1)"
          for c in $COMPONENTS; do
            case "$c" in
              backend)
                cp artifacts/backend/mcpp-ide.okb "dist/mcpp-ide-${backend}.okb"
                cp "artifacts/backend/mcpp-ide-${backend}"-openkal*.tar.gz dist/ ;;
              vscode) cp artifacts/mcpp-vscode-vsix/*.vsix dist/ ;;
              clion) cp artifacts/mcpp-clion-zip/*.zip dist/ ;;
              nvim) ;;   # the tag's source archive is the plugin
            esac
          done
          notes="$RUNNER_TEMP/notes.md"
          printf '%s\n\n' "$TITLE" > "$notes"; cat CHANGELOG.md >> "$notes"
          if [ -n "$(ls dist)" ]; then
            (cd dist && sha256sum * > SHA256SUMS && cat SHA256SUMS)
            gh release create "$GITHUB_REF_NAME" dist/* --target "$GITHUB_SHA" --title "$TITLE" --notes-file "$notes"
          else
            gh release create "$GITHUB_REF_NAME" --target "$GITHUB_SHA" --title "$TITLE" --notes-file "$notes"
          fi

  openvsx:
    needs: [plan, release]
    if: contains(needs.plan.outputs.components, 'vscode')
    runs-on: ubuntu-24.04
    env:
      VERSION: ${{ needs.plan.outputs.version }}
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v5
        with:
          node-version: 22
      - name: Download and verify the published VSIX
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          gh release download "$GITHUB_REF_NAME" -p 'mcpp-vscode-*.vsix' -p SHA256SUMS -D published
          (cd published && sha256sum -c --ignore-missing SHA256SUMS)
      - name: Publish to Open VSX
        env:
          OPENVSX_TOKEN: ${{ secrets.OPENVSX_TOKEN }}
        run: |
          set -euo pipefail
          if [ -z "${OPENVSX_TOKEN:-}" ]; then
            echo "OPENVSX_TOKEN is not set: Open VSX is a required destination of a release."
            echo "Create a token with the publish scope at open-vsx.org (Settings, Access Tokens) and add it"
            echo "as the OPENVSX_TOKEN secret of this repository (Settings, Secrets and variables, Actions)."
            exit 1
          fi
          (cd mide-plugins/vscode && npm ci --ignore-scripts)
          vsix="$(ls published/mcpp-vscode-*.vsix)"
          (cd mide-plugins/vscode && npx ovsx publish "$GITHUB_WORKSPACE/$vsix" --pat "$OPENVSX_TOKEN")

  jetbrains:
    needs: [plan, release]
    if: contains(needs.plan.outputs.components, 'clion')
    uses: ./.github/workflows/publish-jetbrains.yml
    with:
      tag: ${{ github.ref_name }}
    secrets:
      JETBRAINS_TOKEN: ${{ secrets.JETBRAINS_TOKEN }}