github-release.yml

name: GitHub release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag to publish, for example v2.4.0'
        required: true
        default: 'v2.4.0'

permissions:
  contents: write

jobs:
  release:
    name: Create GitHub release
    runs-on: ubuntu-latest
    env:
      RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ env.RELEASE_TAG }}

      - name: Set up Node
        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Install render-proxy dependencies
        run: npm ci --prefix render-proxy

      # render-proxy/ is its own npm package (separate package.json and
      # lockfile) - the root install above never touches it, but `npm test`
      # below includes tests/proxy-routes.integration.test.js and
      # tests/redis-safety.integration.test.js, which import
      # render-proxy/server.js directly. Same gap as ci.yml and
      # chrome-web-store-release.yml.
      - name: Install render-proxy dependencies
        run: npm install --prefix render-proxy

      - name: Validate release metadata
        run: npm run release:validate -- --tag="${RELEASE_TAG}"

      - name: Run tests
        run: npm test

      - name: Package extension
        run: npm run release:chrome -- --skip-tests --allow-dirty

      - name: Validate packaged ZIP
        run: npm run release:validate -- --require-zip --tag="${RELEASE_TAG}"

      - name: Create GitHub release
        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
        with:
          tag_name: ${{ env.RELEASE_TAG }}
          draft: false
          prerelease: false
          generate_release_notes: true
          body_path: CHANGELOG.md
          files: |
            dist/*.zip
            dist/*.zip.sha256