Merge pull request #32 from Post-Math/dev #8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Releases are cut automatically when `main` advances. The job reads the version | |
| # from manifest.json and, if that version has not been released yet, creates and | |
| # pushes the matching tag (bare version, no `v` prefix — Obsidian's convention) | |
| # and publishes the GitHub release with the plugin artifacts. | |
| # | |
| # It is idempotent: a push to `main` that does NOT bump the version (e.g. a CI | |
| # or docs change) finds the tag already exists and does nothing. Tag + release | |
| # happen in the same job, so we don't rely on a tag push triggering a second | |
| # workflow (GITHUB_TOKEN tag pushes don't trigger other workflows). | |
| on: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: write | |
| concurrency: | |
| group: release-main | |
| cancel-in-progress: false | |
| jobs: | |
| release: | |
| name: release | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| id-token: write # mint the provenance signing certificate | |
| attestations: write # write the artifact attestation | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "20" | |
| cache: "npm" | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Lint (eslint-plugin-obsidianmd) | |
| run: npm run lint | |
| - name: Type-check & build (tsc --noEmit + esbuild) | |
| run: npm run build | |
| - name: Validate | |
| run: | | |
| node --check main.js | |
| node scripts/validate.mjs | |
| - name: Read version from manifest | |
| id: meta | |
| run: echo "version=$(node -p "require('./manifest.json').version")" >> "$GITHUB_OUTPUT" | |
| - name: Check whether this version is already released | |
| id: guard | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| V="${{ steps.meta.outputs.version }}" | |
| if gh release view "$V" >/dev/null 2>&1 \ | |
| || [ -n "$(git ls-remote --tags origin "refs/tags/$V")" ]; then | |
| echo "exists=true" >> "$GITHUB_OUTPUT" | |
| echo "Version $V already released or tagged — nothing to do." | |
| else | |
| echo "exists=false" >> "$GITHUB_OUTPUT" | |
| echo "Version $V is new — will tag and release." | |
| fi | |
| - name: Tag the release commit | |
| if: steps.guard.outputs.exists == 'false' | |
| run: | | |
| V="${{ steps.meta.outputs.version }}" | |
| git tag "$V" | |
| git push origin "$V" | |
| # Cryptographically attest that these assets were built from this repo by | |
| # this workflow, so users can verify provenance with `gh attestation verify`. | |
| - name: Attest build provenance | |
| if: steps.guard.outputs.exists == 'false' | |
| uses: actions/attest-build-provenance@v2 | |
| with: | |
| subject-path: | | |
| main.js | |
| styles.css | |
| - name: Create GitHub release | |
| if: steps.guard.outputs.exists == 'false' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| V="${{ steps.meta.outputs.version }}" | |
| gh release create "$V" \ | |
| main.js manifest.json styles.css \ | |
| --title "Lookout $V" \ | |
| --generate-notes |