emdash-release.yml

name: "Publish EmDash plugins"

on:
  workflow_call:
    inputs:
      published-packages:
        description: "Changesets Action published-packages JSON output"
        required: true
        type: string
  workflow_dispatch:
    inputs:
      package:
        description: "Plugin ID to publish"
        required: true
        type: string

permissions: {}

concurrency:
  group: emdash-release-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  plan:
    name: "Plan plugin releases"
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      selectors: ${{ steps.changesets.outputs.selectors || steps.manual.outputs.selectors }}
    steps:
      - name: "Check out repository"
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: "Set up pnpm"
        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4

      - name: "Set up Node.js"
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: 24

      # Keyed on the inputs, not on github.event_name: in a called workflow
      # that is the caller's event (`push`), never `workflow_call`.
      - name: "Plan Changesets plugin releases"
        id: changesets
        if: ${{ inputs.published-packages != '' }}
        shell: bash
        env:
          EMDASH_PUBLISHED_PACKAGES: ${{ inputs.published-packages }}
        run: |
          set -euo pipefail
          pnpm dlx @emdash-cms/plugin-cli@0.12.0 release plan --published-packages "${EMDASH_PUBLISHED_PACKAGES}" --dir .

      - name: "Plan manual plugin release"
        id: manual
        if: ${{ inputs.package != '' }}
        shell: bash
        env:
          EMDASH_RELEASE_SELECTOR: ${{ inputs.package }}
        run: |
          set -euo pipefail
          pnpm dlx @emdash-cms/plugin-cli@0.12.0 release plan --package "${EMDASH_RELEASE_SELECTOR}" --dir .

  # Build and publish run in separate jobs; this one gets no id-token.
  build:
    name: "Build ${{ matrix.selector }}"
    needs: plan
    if: ${{ needs.plan.outputs.selectors != '[]' }}
    strategy:
      fail-fast: false
      matrix:
        selector: ${{ fromJSON(needs.plan.outputs.selectors) }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: "Check repository visibility"
        if: ${{ github.event.repository.visibility != 'public' }}
        run: |
          echo "::error title=Public repository required::EmDash releases currently require a public GitHub repository because private and internal repository attestations cannot yet be verified."
          exit 1

      - name: "Check out repository"
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: "Set up pnpm"
        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4

      - name: "Set up Node.js"
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: 24
          cache: pnpm

      - name: "Install dependencies"
        run: pnpm install --frozen-lockfile

      - name: "Prepare plugin release"
        id: prepare
        shell: bash
        env:
          EMDASH_RELEASE_SELECTOR: "${{ matrix.selector }}"
        run: |
          set -euo pipefail
          pnpm dlx @emdash-cms/plugin-cli@0.12.0 release prepare "${EMDASH_RELEASE_SELECTOR}" --dir . --out-dir .emdash-release

      - name: "Record the publisher"
        shell: bash
        env:
          PUBLISHER_DID: ${{ steps.prepare.outputs.publisher-did }}
        run: printf '%s\n' "${PUBLISHER_DID}" > .emdash-release/publisher-did

      - name: "Hand over the bundle"
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: emdash-release-${{ matrix.selector }}
          path: |
            ${{ steps.prepare.outputs.bundle-file }}
            .emdash-release/publisher-did
          if-no-files-found: error
          retention-days: 1

  publish:
    name: "Publish ${{ matrix.selector }}"
    needs: [plan, build]
    if: ${{ needs.plan.outputs.selectors != '[]' }}
    strategy:
      fail-fast: false
      matrix:
        selector: ${{ fromJSON(needs.plan.outputs.selectors) }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write # Required for the audience-bound GitHub OIDC token.
      attestations: write # Required to sign build provenance.
    steps:
      - name: "Download the bundle"
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: emdash-release-${{ matrix.selector }}
          path: .emdash-release

      - name: "Read the bundle"
        id: bundle
        shell: bash
        run: |
          set -euo pipefail
          shopt -s nullglob
          files=(.emdash-release/*.tar.gz)
          if [ "${#files[@]}" -ne 1 ]; then
            echo "::error::expected one plugin bundle, found ${#files[@]}"
            exit 1
          fi
          echo "bundle-file=${files[0]}" >> "${GITHUB_OUTPUT}"
          echo "publisher-did=$(cat .emdash-release/publisher-did)" >> "${GITHUB_OUTPUT}"

      - name: "Create build provenance"
        id: attest
        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
        with:
          subject-path: ${{ steps.bundle.outputs.bundle-file }}

      - name: "Publish plugin"
        uses: emdash-cms/emdash/apps/release-action@main # zizmor: ignore[unpinned-uses] -- configured by --action-ref
        with:
          service-url: https://releases.emdashcms.com
          publisher-did: ${{ steps.bundle.outputs.publisher-did }}
          bundle-file: ${{ steps.bundle.outputs.bundle-file }}
          provenance-file: ${{ steps.attest.outputs.bundle-path }}