release.yml

name: Release

# A tag vYYYY.MM.DD publishes every sample and the index.json that nodes read at
# releases/latest/download/. A published release is never changed: a fix is a new tag.
on:
  push:
    tags: ["v*"]

permissions:
  contents: read

jobs:
  check:
    uses: ./.github/workflows/check.yml
    permissions:
      contents: read

  release:
    needs: check
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      # The release a tag makes becomes the latest, which every node reads. So the tag must be on main's
      # newest commit, and the newest tag: an older commit or day would leave out what main has, or move
      # every node back. (fetch-depth 0 fetches origin/main.)
      - name: Only the newest tag, on main's newest commit, is released, and only once
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          main="$(git rev-parse origin/main)"
          if [ "$GITHUB_SHA" != "$main" ]; then
            if git merge-base --is-ancestor "$GITHUB_SHA" "$main"; then
              echo "::error::$GITHUB_REF_NAME leaves out what main has since. Pull main and tag its newest commit."
              git log --oneline "$GITHUB_SHA..$main"
            else
              echo "::error::$GITHUB_REF_NAME is not on main"
            fi
            exit 1
          fi
          newest="$(git tag -l 'v[0-9][0-9][0-9][0-9].[0-9][0-9].[0-9][0-9]*' | sort -V | tail -1)"
          if [ "$newest" != "$GITHUB_REF_NAME" ]; then
            echo "::error::$newest is newer than $GITHUB_REF_NAME"
            exit 1
          fi
          draft="$(gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --json isDraft --jq .isDraft 2> /dev/null || echo none)"
          if [ "$draft" = false ]; then
            echo "::error::$GITHUB_REF_NAME is released already. Tag a new release instead."
            exit 1
          fi
          # A draft is what a failed run leaves behind; this run makes it again. The tag stays.
          if [ "$draft" = true ]; then
            gh release delete "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --yes
          fi
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 22
      - run: node scripts/build.mjs "$GITHUB_REF_NAME"
      # A draft takes every asset before it is published, so the release is whole once it is immutable.
      - name: Publish
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          gh release create "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --draft \
            --title "$GITHUB_REF_NAME" \
            --notes "Sample workspaces for Stuga: each \`<id>.stuga.zip\` is one workspace archive, and \`index.json\` lists them." \
            dist/*.stuga.zip dist/index.json
          gh release edit "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --draft=false --latest