release.yml

name: Release plugin

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write
  id-token: write
  attestations: write

jobs:
  validate:
    name: Validate before release
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

      - name: Set up Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
        with:
          go-version-file: go.mod
          cache: true

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.x"

      - name: Verify manifest version matches the release tag
        run: |
          tag_version="${GITHUB_REF_NAME#v}"
          manifest_version="$(python3 -c "import json; print(json.load(open('manifest.json'))['version'])")"
          if [ "${tag_version}" != "${manifest_version}" ]; then
            echo "manifest.json version (${manifest_version}) does not match release tag (${GITHUB_REF_NAME})" >&2
            exit 1
          fi

      - name: Verify RELEASE_DIGESTS.json pins this exact commit
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          tag_version="${GITHUB_REF_NAME#v}"
          # Read from master's current tip via the API rather than the
          # checked-out tag commit's own tree. The digest entry necessarily
          # lands in a commit *after* the tagged one: it records that
          # commit's own SHA, which only exists once the tagged commit
          # itself does, so a commit can never contain the correct entry for
          # its own hash. By the time the tag is pushed, the entry lives on
          # master, one or more commits ahead of the tag it describes.
          pinned="$(gh api "repos/${GITHUB_REPOSITORY}/contents/RELEASE_DIGESTS.json?ref=master" --jq '.content' \
            | base64 -d \
            | python3 -c "import json,sys; print(json.load(sys.stdin).get('${tag_version}', ''))")"
          if [ -z "${pinned}" ]; then
            echo "RELEASE_DIGESTS.json (on master) has no entry for version ${tag_version}." >&2
            echo "Add one mapping \"${tag_version}\" to this commit's SHA (${GITHUB_SHA}), commit it to master, then push the tag." >&2
            exit 1
          fi
          if [ "${pinned}" != "${GITHUB_SHA}" ]; then
            echo "RELEASE_DIGESTS.json entry for ${tag_version} (${pinned}) does not match the tagged commit (${GITHUB_SHA})." >&2
            exit 1
          fi

      - name: Validate plugin
        run: |
          python -m json.tool manifest.json >/dev/null
          python -m unittest discover -s tests -v
          bash -n scripts/install.sh scripts/backup.sh scripts/restore.sh scripts/database-tools.sh

      - name: Test Go backend
        run: go test -race ./...

  build-binaries:
    name: Build ${{ matrix.goos }}/${{ matrix.goarch }} binary
    needs: validate
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - goos: linux
            goarch: amd64
          - goos: linux
            goarch: arm64
          - goos: darwin
            goarch: amd64
          - goos: darwin
            goarch: arm64
    steps:
      - name: Check out repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

      - name: Set up Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
        with:
          go-version-file: go.mod
          cache: true

      - name: Build binary
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
          CGO_ENABLED: "0"
        run: |
          version="${GITHUB_REF_NAME#v}"
          out="feader-rss-fetch_${version}_${GOOS}_${GOARCH}"
          checksum="checksums_${GOOS}_${GOARCH}.txt"
          go build -trimpath -ldflags "-s -w -X main.version=${version}" -o "${out}" ./cmd/feader-rss-fetch
          sha256sum "${out}" > "${checksum}"

      - name: Upload artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: binary-${{ matrix.goos }}-${{ matrix.goarch }}
          path: |
            feader-rss-fetch_*
            checksums_${{ matrix.goos }}_${{ matrix.goarch }}.txt
          retention-days: 1

  release:
    name: Package and publish release
    needs: build-binaries
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

      - name: Download all binaries
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          pattern: binary-*
          path: dist
          merge-multiple: true

      - name: Combine checksums
        run: |
          shopt -s nullglob
          checksum_files=(dist/checksums_*.txt)
          if [ "${#checksum_files[@]}" -ne 4 ]; then
            echo "Expected four per-platform checksum files, found ${#checksum_files[@]}" >&2
            exit 1
          fi
          sort -k2 "${checksum_files[@]}" > checksums.txt
          if [ "$(wc -l < checksums.txt)" -ne 4 ]; then
            echo "Expected four checksum entries" >&2
            exit 1
          fi
          rm -f "${checksum_files[@]}"

      - name: Read plugin metadata
        id: metadata
        run: |
          python3 - <<'PY' >> "$GITHUB_OUTPUT"
          import json
          from pathlib import Path

          manifest = json.loads(Path("manifest.json").read_text())
          print(f"plugin_id={manifest['id']}")
          print(f"plugin_name={manifest['name']}")
          PY

      - name: Build plugin archive
        env:
          PLUGIN_ID: ${{ steps.metadata.outputs.plugin_id }}
          PLUGIN_VERSION: ${{ github.ref_name }}
        id: package
        run: |
          archive="${PLUGIN_ID}-${PLUGIN_VERSION}.zip"
          zip -q "$archive" \
            manifest.json \
            BarWidget.qml \
            Panel.qml \
            README.md \
            LICENSE \
            preview.png \
            example-config.json
          echo "archive=$archive" >> "$GITHUB_OUTPUT"

      - name: Attest build provenance
        uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018 # v1
        with:
          subject-path: |
            dist/feader-rss-fetch_*
            checksums.txt
            ${{ steps.package.outputs.archive }}

      - name: Extract this version's changelog section
        run: |
          tag_version="${GITHUB_REF_NAME#v}"
          awk -v ver="${tag_version}" '
            $0 ~ ("^## \\[" ver "\\]") { found=1; next }
            found && /^## \[/ { exit }
            found { print }
          ' docs/CHANGELOG.md > release-notes.md
          if [ ! -s release-notes.md ]; then
            echo "docs/CHANGELOG.md has no [${tag_version}] section (or it's empty)." >&2
            echo "Add one before tagging so the release has real notes." >&2
            exit 1
          fi

      - name: Publish GitHub Release
        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
        with:
          body_path: release-notes.md
          generate_release_notes: true
          files: |
            ${{ steps.package.outputs.archive }}
            dist/feader-rss-fetch_*
            checksums.txt