release.yml

name: Release

# Cutting a release is pushing a tag. Everything below derives from it, so the
# tag is the single place a version is decided.
#
#   git tag v0.2.0 && git push origin v0.2.0
#
# The app, the Studio plugin, and the MCP server are built from the same commit
# and stamped with the same version, because a release where those three differ
# is the failure this whole pipeline exists to prevent.
on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"

permissions:
  contents: write

jobs:
  # electron-builder creates the draft itself if one is missing, and it creates
  # it once per publisher — but it caches publishers behind an `await`, so two
  # artifacts finishing together each build their own, each finds no release,
  # and each POSTs one. GitHub allows the duplicate because a draft carries no
  # git tag, so the run ends with two releases holding a split set of
  # installers, and whichever one `gh` happens to publish below is the one the
  # update feed gets.
  #
  # Reserving it here closes the race: both publishers find this one. A failed
  # run leaves the draft behind on purpose — cutting a release is a deliberate
  # act, and the draft is what you look at to see how far it got.
  draft:
    name: Reserve the release
    runs-on: ubuntu-latest
    steps:
      - name: Create the draft
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Stands in for a checkout: gh needs to know the repo, and the tag is
          # already pushed, so there is nothing here to read off disk.
          GH_REPO: ${{ github.repository }}
        run: |
          # Re-running a release asks for a tag that already has a draft — and
          # GitHub would happily make a second one, which is the thing this job
          # exists to prevent.
          if gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1; then
            echo "Already reserved: $GITHUB_REF_NAME"
            exit 0
          fi

          gh release create "$GITHUB_REF_NAME" \
            --draft \
            --title "${GITHUB_REF_NAME#v}" \
            --generate-notes

  plugin:
    name: Studio plugin
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: CompeyDev/setup-rokit@v0.1.2
      - name: Install Luumen
        run: |
          curl -fsSL https://luumen.dev/install.sh | bash
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      # The plugin reports its version to the app over the wire, so it carries
      # the release version rather than whatever was last committed. The channel
      # decides its icon, toolbar, and widget, and is "dev" in source — without
      # this a release would ship wearing the dev icon.
      - name: Stamp the version and channel
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          sed -i "s/^Constants.PLUGIN_VERSION = .*/Constants.PLUGIN_VERSION = \"${VERSION}\"/" plugin/src/Constants.luau
          sed -i "s/^Constants.CHANNEL = .*/Constants.CHANNEL = \"release\"/" plugin/src/Constants.luau
          grep -E "PLUGIN_VERSION|^Constants.CHANNEL" plugin/src/Constants.luau

      - run: luu install
        working-directory: plugin
      - run: luu run check
        working-directory: plugin
      - run: luu run bundle
        working-directory: plugin

      - uses: actions/upload-artifact@v4
        with:
          name: studio-plugin
          path: plugin/LuuCode.rbxm
          if-no-files-found: error

  app:
    name: App (${{ matrix.os }})
    needs: [draft, plugin]
    runs-on: ${{ matrix.os }}
    strategy:
      # One platform failing should not throw away installers that already
      # built; the draft release keeps whatever arrived.
      fail-fast: false
      matrix:
        # Windows only for now. There is no Linux build — Luu Code drives Studio,
        # and Studio does not run there. macOS is paused, not dropped: add
        # macos-latest back here, and to ci.yml and nightly.yml alongside it.
        os: [windows-latest]
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - run: pnpm install --frozen-lockfile

      - name: Set the version from the tag
        shell: bash
        run: node .github/scripts/set-version.mjs "${GITHUB_REF_NAME#v}"

      # Packaged as a resource, so the app can install a plugin that matches
      # itself instead of asking the user to find the right .rbxm.
      - uses: actions/download-artifact@v4
        with:
          name: studio-plugin
          path: packages/app/build/plugin

      - run: pnpm turbo run build typecheck test

      - name: Package and publish
        working-directory: packages/app
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Unsigned for now. Adding CSC_LINK and CSC_KEY_PASSWORD here, and
          # APPLE_ID / APPLE_APP_SPECIFIC_PASSWORD / APPLE_TEAM_ID for
          # notarization, is all that is needed to turn signing on.
          CSC_IDENTITY_AUTO_DISCOVERY: "false"
        run: pnpm exec electron-builder --config electron-builder.cjs --publish always

  publish:
    name: Publish the release
    needs: [draft, plugin, app]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/download-artifact@v4
        with:
          name: studio-plugin
          path: dist

      # The draft reserved above is still a draft; the plugin goes in beside
      # the installers before anyone can see a half-built release.
      - name: Attach the plugin and publish
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release upload "$GITHUB_REF_NAME" dist/LuuCode.rbxm --clobber
          gh release edit "$GITHUB_REF_NAME" --draft=false --latest