flow-opencode/.github/workflows/release.yml at main · ddv1982/flow-opencode · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write
  id-token: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          registry-url: 'https://registry.npmjs.org'
          package-manager-cache: false

      - name: Set up npm trusted publishing support
        run: |
          npm install --global npm@11.18.0
          node --version
          npm --version

      - name: Set up Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.3.14

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Validate release tag and changelog
        run: bun run release:metadata -- --tag "${GITHUB_REF_NAME}" --notes-file release-notes.md

      - name: Run checks
        run: bun run check

      - name: Run pinned live OpenCode smoke
        run: bun run smoke:live

      - name: Prepare package
        shell: bash
        run: |
          set -euo pipefail
          bun pm pack --destination .
          tarball="$(ls opencode-plugin-flow-*.tgz)"
          shasum -a 256 "$tarball" > "${tarball}.sha256"

      - name: Publish to npm
        shell: bash
        run: |
          set -euo pipefail
          package_name="$(node -p "require('./package.json').name")"
          package_version="$(node -p "require('./package.json').version")"
          tarball="$(ls opencode-plugin-flow-*.tgz)"
          local_integrity="$(node --input-type=module -e '
            import { createHash } from "node:crypto";
            import { readFileSync } from "node:fs";
            process.stdout.write("sha512-" + createHash("sha512").update(readFileSync(process.argv[1])).digest("base64"));
          ' "$tarball")"
          registry_error_file="$(mktemp)"

          if published_integrity="$(npm view "${package_name}@${package_version}" dist.integrity 2>"$registry_error_file")"; then
            if [[ "$published_integrity" != "$local_integrity" ]]; then
              echo "::error::npm already contains ${package_name}@${package_version} with different tarball integrity."
              exit 1
            fi
            echo "npm already contains the exact ${package_name}@${package_version} tarball; skipping publish."
          else
            registry_error="$(<"$registry_error_file")"
            if [[ "$registry_error" != *"E404"* && "$registry_error" != *"No match found"* ]]; then
              printf '%s\n' "$registry_error" >&2
              exit 1
            fi
            npm publish "$tarball" --access public
          fi

      - name: Publish GitHub release assets
        env:
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          set -euo pipefail
          tag="${GITHUB_REF_NAME}"
          tarball="$(ls opencode-plugin-flow-*.tgz)"
          release_query_error_file="$(mktemp)"

          retry_idempotent() {
            local attempt=1
            local maximum_attempts=5
            local retry_delay_seconds

            until "$@"; do
              if (( attempt >= maximum_attempts )); then
                return 1
              fi
              retry_delay_seconds=$((attempt * 15))
              echo "Retrying idempotent GitHub release operation in ${retry_delay_seconds}s (attempt $((attempt + 1))/${maximum_attempts})."
              sleep "$retry_delay_seconds"
              attempt=$((attempt + 1))
            done
          }

          if gh release view "$tag" >/dev/null 2>"$release_query_error_file"; then
            retry_idempotent gh release edit "$tag" --title "$tag" --notes-file release-notes.md
          else
            release_query_error="$(<"$release_query_error_file")"
            if [[ "$release_query_error" != *"release not found"* && "$release_query_error" != *"HTTP 404"* ]]; then
              printf '%s\n' "$release_query_error" >&2
              exit 1
            fi
            gh release create "$tag" --title "$tag" --notes-file release-notes.md
          fi

          retry_idempotent gh release upload "$tag" "$tarball" --clobber
          retry_idempotent gh release upload "$tag" "${tarball}.sha256" --clobber