release.yml

name: Build and publish app release

# Builds the Nextcloud appstore-ready tarball
# (`exelearning-<version>.tar.gz`, with the bundled eXeLearning static
# editor inside) and publishes it to a GitHub Release.
#
# Triggered automatically when a release is published, and available
# via `workflow_dispatch` for manual builds — handy when refreshing
# the bundled editor against a new upstream tag without changing any
# app code (mirrors the wp-exelearning auto-release flow).

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      editor_ref:
        description: "eXeLearning editor tag to bundle (e.g. v3.7.0). 'latest' resolves the most recent GitHub release."
        required: false
        default: "latest"
      version:
        description: "Override package version label (defaults to the editor tag without the leading v)"
        required: false
        default: ""

permissions:
  contents: write

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Read app metadata from appinfo/info.xml
        id: meta
        run: |
          set -euo pipefail
          APP_ID=$(sed -n 's:.*<id>\(.*\)</id>.*:\1:p' appinfo/info.xml | head -n1)
          INFO_VERSION=$(sed -n 's:.*<version>\(.*\)</version>.*:\1:p' appinfo/info.xml | head -n1)
          PHP_MIN=$(sed -n 's:.*<php[^>]*min-version="\([0-9.]*\)".*:\1:p' appinfo/info.xml | head -n1)
          echo "app_id=$APP_ID" >> "$GITHUB_OUTPUT"
          echo "info_version=$INFO_VERSION" >> "$GITHUB_OUTPUT"
          echo "php_version=${PHP_MIN:-8.1}" >> "$GITHUB_OUTPUT"

      # Resolve the editor tag once at the top of the job so the same
      # value powers the editor download, the package version (when
      # workflow_dispatch defaults), and the GitHub Release tag.
      - name: Resolve eXeLearning editor tag
        id: editor
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          INPUT_REF: ${{ github.event.inputs.editor_ref }}
        run: |
          set -euo pipefail
          REF="${INPUT_REF:-latest}"
          if [ -z "$REF" ] || [ "$REF" = "latest" ]; then
            REF=$(gh api repos/exelearning/exelearning/releases/latest --jq '.tag_name')
          fi
          if [ -z "$REF" ]; then
            echo "::error::Could not resolve a latest editor release."; exit 1
          fi
          echo "ref=$REF" >> "$GITHUB_OUTPUT"
          echo "Editor tag: $REF"

      - name: Resolve package version
        id: version
        env:
          INPUT_VERSION: ${{ github.event.inputs.version }}
          INFO_VERSION: ${{ steps.meta.outputs.info_version }}
          EDITOR_REF: ${{ steps.editor.outputs.ref }}
        run: |
          set -euo pipefail
          if [ "${{ github.event_name }}" = "release" ]; then
            RAW="${GITHUB_REF##*/}"
            VERSION="${RAW#v}"
          elif [ -n "${INPUT_VERSION}" ]; then
            VERSION="${INPUT_VERSION}"
          else
            # Default for workflow_dispatch: use the editor tag as the
            # package version so refreshes are easy to trace, matching
            # the wp-exelearning convention.
            VERSION="${EDITOR_REF#v}"
          fi
          if [ -z "$VERSION" ]; then
            echo "::error::Could not resolve a version label."; exit 1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Package version: $VERSION"

      - name: Resolve GitHub Release tag
        id: tag
        env:
          EDITOR_REF: ${{ steps.editor.outputs.ref }}
        run: |
          set -euo pipefail
          if [ "${{ github.event_name }}" = "release" ]; then
            TAG="${GITHUB_REF##*/}"
          else
            TAG="${EDITOR_REF}"
          fi
          echo "name=$TAG" >> "$GITHUB_OUTPUT"

      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: npm

      - name: Set up PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: ${{ steps.meta.outputs.php_version }}
          tools: composer:v2
          coverage: none

      - name: Install dependencies
        run: |
          npm ci
          if [ -f composer.json ]; then
            composer install --no-dev --prefer-dist --optimize-autoloader || true
          fi

      # `make download-editor` reads EXELEARNING_EDITOR_REF from env.
      # Bundling the prebuilt static editor (~73 MB) is what makes the
      # release tarball usable out of the box; without it the .elpx
      # editor route 404s in production installs.
      - name: Download the eXeLearning static editor
        env:
          EXELEARNING_EDITOR_REF: ${{ steps.editor.outputs.ref }}
        run: make download-editor

      - name: Build the Nextcloud distribution tarball
        run: make package PACKAGE_VERSION=${{ steps.version.outputs.version }}

      - name: Compute artefact paths
        id: artefact
        env:
          APP_ID: ${{ steps.meta.outputs.app_id }}
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          set -euo pipefail
          NAME="${APP_ID}-${VERSION}.tar.gz"
          PATH_REL="build/artifacts/${NAME}"
          test -f "${PATH_REL}" || { echo "::error::Expected ${PATH_REL} but it was not produced."; exit 1; }
          echo "name=${NAME}" >> "$GITHUB_OUTPUT"
          echo "path=${PATH_REL}" >> "$GITHUB_OUTPUT"
          echo "Tarball size: $(du -h "${PATH_REL}" | cut -f1)"

      # Publishing needs two secrets: APP_PRIVATE_KEY (the key whose CSR
      # was approved in nextcloud/app-certificate-requests) and
      # APPSTORE_TOKEN (apps.nextcloud.com account token). Until both are
      # set the release still builds and ships on GitHub, it just does not
      # reach the appstore.
      - name: Check appstore credentials
        id: credentials
        env:
          APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
          APPSTORE_TOKEN: ${{ secrets.APPSTORE_TOKEN }}
        run: |
          set -euo pipefail
          if [ -n "${APP_PRIVATE_KEY:-}" ] && [ -n "${APPSTORE_TOKEN:-}" ]; then
            echo "ready=true" >> "$GITHUB_OUTPUT"
          else
            echo "::warning::APP_PRIVATE_KEY/APPSTORE_TOKEN not set - skipping the appstore publish."
            echo "ready=false" >> "$GITHUB_OUTPUT"
          fi

      # Signs in place, so the tarball attached to the release below is the
      # signed one the appstore will hand to servers.
      - name: Sign the app code
        if: steps.credentials.outputs.ready == 'true'
        env:
          APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
          APP_ID: ${{ steps.meta.outputs.app_id }}
        run: |
          set -euo pipefail
          printf '%s\n' "$APP_PRIVATE_KEY" > "${RUNNER_TEMP}/${APP_ID}.key"
          curl -fsSL -o "${RUNNER_TEMP}/${APP_ID}.crt" \
            "https://raw.githubusercontent.com/nextcloud/app-certificate-requests/master/${APP_ID}/${APP_ID}.crt"
          tools/sign-app.sh "${{ steps.artefact.outputs.path }}" \
            "${RUNNER_TEMP}/${APP_ID}.key" "${RUNNER_TEMP}/${APP_ID}.crt"
          rm -f "${RUNNER_TEMP}/${APP_ID}.key"

      - name: Upload tarball as workflow artefact
        uses: actions/upload-artifact@v7
        with:
          name: ${{ steps.artefact.outputs.name }}
          path: ${{ steps.artefact.outputs.path }}

      # On `release: published` the release already exists and we just
      # add the tarball to it. On `workflow_dispatch` the release is
      # created (or updated) using the editor tag as the release name —
      # the same flow wp-exelearning uses for editor refreshes.
      - name: Publish to GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ steps.tag.outputs.name }}
          name: ${{ steps.tag.outputs.name }}
          files: ${{ steps.artefact.outputs.path }}
          fail_on_unmatched_files: true
          body: |
            Automated build bundling the eXeLearning static editor `${{ steps.editor.outputs.ref }}`.

            App version: `${{ steps.version.outputs.version }}` (from
            `appinfo/info.xml`: `${{ steps.meta.outputs.info_version }}`).
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      # The appstore only stores the URL: it downloads the tarball from the
      # GitHub release, so this must run after the release asset exists.
      - name: Publish to the Nextcloud appstore
        if: steps.credentials.outputs.ready == 'true'
        uses: nextcloud-libraries/nextcloud-appstore-push-action@v1.0.3
        with:
          app_name: ${{ steps.meta.outputs.app_id }}
          appstore_token: ${{ secrets.APPSTORE_TOKEN }}
          app_private_key: ${{ secrets.APP_PRIVATE_KEY }}
          download_url: https://github.com/${{ github.repository }}/releases/download/${{ steps.tag.outputs.name }}/${{ steps.artefact.outputs.name }}