release.yml

name: Release Pipeline

on:
  release:
    types: [published]
  workflow_dispatch:

permissions:
  contents: write
  id-token: write

env:
  PY_VERSION: "3.12.9"
  PY_EMBED_URL: "https://www.python.org/ftp/python/3.12.9/python-3.12.9-embed-amd64.zip"

jobs:
  # ─────────────────────────────────────────────
  # Stage 1: Build & publish platform-specific VSCode extensions
  #
  # Windows: bundles Windows Embeddable Python + diffinite source
  #   → no PyInstaller, no antivirus false-positives
  # Mac/Linux: TS-only VSIX, relies on system python3 at runtime
  # ─────────────────────────────────────────────
  publish-vsce:
    name: Publish VSIX (${{ matrix.target }})
    # Job-level so the Open VSX step's `if` can read it — a step's own step-level
    # env is NOT visible to that same step's `if` condition.
    env:
      OVSX_PAT: ${{ secrets.OVSX_PAT }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: win32-x64
            runner: windows-latest
            bundle_python: true
          - target: linux-x64
            runner: ubuntu-latest
            bundle_python: false
          - target: darwin-arm64
            runner: ubuntu-latest
            bundle_python: false
    runs-on: ${{ matrix.runner }}

    steps:
      - uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      # Fail fast if the release tag and the packaged version disagree, so we
      # never publish a VSIX whose version differs from the tag people see.
      - name: Verify version matches release tag
        if: github.event_name == 'release'
        shell: bash
        run: |
          TAG="${{ github.event.release.tag_name }}"
          VER="${TAG#v}"
          PKG=$(node -p "require('./vscode-extension/package.json').version")
          echo "tag=$TAG  expected=$VER  package.json=$PKG"
          if [ "$VER" != "$PKG" ]; then
            echo "::error::package.json version ($PKG) does not match release tag ($VER)"
            exit 1
          fi

      - name: Install Extension dependencies
        working-directory: vscode-extension
        run: npm install

      - name: Compile TypeScript
        working-directory: vscode-extension
        run: npx tsc -p ./

      # ── Windows: Bundle Embeddable Python ──────────────────────
      - name: Build Standalone Bundle (CD Tester)
        if: matrix.bundle_python
        shell: pwsh
        run: |
          ./vscode-extension/scripts/build_bundle.ps1 -pythonVersion ${{ env.PY_VERSION }}

      # ── Common: Record metadata & package VSIX ─────────────────
      - name: Record build metadata
        working-directory: vscode-extension
        shell: bash
        run: |
          mkdir -p bin
          echo '{
            "commit": "${{ github.sha }}",
            "tag": "${{ github.event.release.tag_name || github.ref_name }}",
            "target": "${{ matrix.target }}",
            "python_version": "${{ matrix.bundle_python && env.PY_VERSION || 'system' }}",
            "built_at": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"
          }' > bin/build-info.json
          cat bin/build-info.json

      - name: Install vsce
        run: npm install -g @vscode/vsce@3.2.2

      - name: Package platform-specific VSIX
        working-directory: vscode-extension
        run: >-
          vsce package
          --target ${{ matrix.target }}
          --no-dependencies
          --allow-star-activation

      - name: Upload VSIX artifact
        uses: actions/upload-artifact@v4
        with:
          name: vsix-${{ matrix.target }}
          path: vscode-extension/*.vsix

      - name: Upload VSIX to Release
        if: github.event_name == 'release'
        uses: softprops/action-gh-release@v2
        with:
          files: vscode-extension/*.vsix

      # No continue-on-error: a failed Marketplace publish (e.g. an expired
      # VSCE_PAT) MUST turn the job red. The retry loop now records success and
      # exits non-zero when all attempts fail, instead of silently ending on the
      # trailing Start-Sleep.
      - name: Publish to VSCode Marketplace
        if: github.event_name == 'release'
        working-directory: vscode-extension
        timeout-minutes: 10
        shell: pwsh
        run: |
          $vsix = (Get-ChildItem *.vsix | Select-Object -First 1).Name
          Write-Output "Publishing $vsix to VS Code Marketplace..."
          $published = $false
          for ($i = 1; $i -le 3; $i++) {
            Write-Output "Attempt $i/3..."
            vsce publish --packagePath $vsix -p ${{ secrets.VSCE_PAT }}
            if ($LASTEXITCODE -eq 0) { $published = $true; break }
            Write-Output "Attempt $i failed (exit $LASTEXITCODE)."
            if ($i -lt 3) { Write-Output "Waiting 30s..."; Start-Sleep -Seconds 30 }
          }
          if (-not $published) {
            Write-Error "vsce publish failed after 3 attempts. Is VSCE_PAT valid and unexpired?"
            exit 1
          }

      # Open VSX (for Cursor / VSCodium / Windsurf / Eclipse Theia users).
      # Opt-in: skipped unless an OVSX_PAT secret is configured, so it never
      # blocks a release before the Open VSX namespace/token is set up.
      # Prerequisite (one-time): `ovsx create-namespace nash-dir -p <OVSX_PAT>`.
      - name: Publish to Open VSX
        if: github.event_name == 'release' && env.OVSX_PAT != ''
        working-directory: vscode-extension
        timeout-minutes: 10
        shell: pwsh
        run: |
          npm install -g ovsx
          $vsix = (Get-ChildItem *.vsix | Select-Object -First 1).Name
          Write-Output "Publishing $vsix to Open VSX..."
          $published = $false
          for ($i = 1; $i -le 3; $i++) {
            Write-Output "Attempt $i/3..."
            ovsx publish $vsix -p $env:OVSX_PAT
            if ($LASTEXITCODE -eq 0) { $published = $true; break }
            Write-Output "Attempt $i failed (exit $LASTEXITCODE)."
            if ($i -lt 3) { Write-Output "Waiting 30s..."; Start-Sleep -Seconds 30 }
          }
          if (-not $published) {
            Write-Error "ovsx publish failed after 3 attempts. Is OVSX_PAT valid and the namespace created?"
            exit 1
          }

  # ─────────────────────────────────────────────
  # Stage 2: Publish to PyPI
  # Independent of VSIX builds.
  # ─────────────────────────────────────────────
  publish-pypi:
    name: Publish to PyPI
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/diffinite
    permissions:
      id-token: write

    steps:
      - uses: actions/checkout@v4

      - name: Verify version matches release tag
        if: github.event_name == 'release'
        shell: bash
        run: |
          TAG="${{ github.event.release.tag_name }}"
          VER="${TAG#v}"
          PYP=$(grep -m1 '^version' pyproject.toml | sed -E 's/.*"([^"]+)".*/\1/')
          echo "tag=$TAG  expected=$VER  pyproject=$PYP"
          if [ "$VER" != "$PYP" ]; then
            echo "::error::pyproject.toml version ($PYP) does not match release tag ($VER)"
            exit 1
          fi

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install build tools
        run: pip install build

      - name: Build package
        run: python -m build

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1