release.yml

name: Release

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

on:
  create:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+' # Matches semantic version tags like v1.2.3

env:
  artifact-prefix: pkg-${{ github.run_id }}

jobs:
  release-metadata:
    name: Define Release Metadata
    runs-on: ubuntu-latest
    environment: release
    timeout-minutes: 30
    outputs:
      version: ${{ steps.target-version.outputs.version }}
      version-tag: ${{ steps.target-version.outputs.version-tag }}
      changelog: ${{ steps.changelog.outputs.release }}
      should-release: ${{ steps.validate-tag.outputs.should-release }}

    steps:
      - name: Validate semantic version tag
        id: validate-tag
        run: |
          if [[ "${{ github.ref_type }}" == "tag" ]] && [[ "${{ github.ref_name }}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "should-release=true" >> $GITHUB_OUTPUT
            echo "Valid semantic version tag: ${{ github.ref_name }}"
          else
            echo "should-release=false" >> $GITHUB_OUTPUT
            echo "Not a semantic version tag, skipping release"
          fi

      - uses: actions/checkout@v5
        if: steps.validate-tag.outputs.should-release == 'true'
        with:
          fetch-depth: 0

      - name: Setup git
        if: steps.validate-tag.outputs.should-release == 'true'
        id: setup-git
        uses: ./.github/actions/setup-git-as-bot
        with:
          app-id: ${{ vars.MH_BOT_APP_ID }}
          app-private-key: ${{ secrets.MH_BOT_APP_PRIVATE_KEY }}

      - name: Enable corepack
        if: steps.validate-tag.outputs.should-release == 'true'
        run: corepack enable

      - name: Setup Node.js
        if: steps.validate-tag.outputs.should-release == 'true'
        uses: actions/setup-node@v4.4.0
        with:
          node-version: '22.x'
          cache: 'yarn'
          cache-dependency-path: '**/yarn.lock' # Cache all workspaces' yarn.lock

      - name: Install Dependencies
        if: steps.validate-tag.outputs.should-release == 'true'
        run: yarn install --immutable

      - name: Check env file
        shell: bash
        run: |
          echo "${{ secrets.ENV_FILE }}" | base64 -d >> .env
          if ! grep -q "DSN" .env; then
            echo "error: DSN not found in .env file" >&2
            exit 1
          fi

      - name: Run Tests
        if: steps.validate-tag.outputs.should-release == 'true'
        run: |
          yarn lint
          yarn ci:all
          yarn check:all

      - name: Confirm version
        if: steps.validate-tag.outputs.should-release == 'true'
        id: target-version
        shell: bash
        run: |
          VERSION=$(jq -r .version package.json)
          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "version-tag=v$VERSION" >> $GITHUB_OUTPUT

      - name: Extract Changelog
        if: steps.validate-tag.outputs.should-release == 'true'
        id: changelog
        uses: zogot/kacl-parser@1.0.0
        with:
          version: ${{ steps.target-version.outputs.version }}

  build:
    name: Build (${{matrix.browser}})
    needs: release-metadata
    if: needs.release-metadata.outputs.should-release == 'true'
    runs-on: ubuntu-latest
    environment: release
    strategy:
      matrix:
        node-version: [22.x]
        browser: [chrome, edge, firefox]
    steps:
      - uses: actions/checkout@v4

      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'yarn'

      - name: Set yarn version
        run: yarn set version 4.9.1

      - name: Check env file
        shell: bash
        run: |
          echo "${{ secrets.ENV_FILE }}" | base64 -d >> .env
          if ! grep -q "DSN" .env; then
            echo "error: DSN not found in .env file" >&2
            exit 1
          fi

      - name: Build ${{ matrix.browser }}
        run: |
          yarn install --immutable
          yarn check-envfile
          yarn build:tools

          if [ "${{ matrix.browser }}" = "chrome" ]; then
            yarn build:chrome:all
          elif [ "${{ matrix.browser }}" = "edge" ]; then
            yarn build:edge:all
          elif [ "${{ matrix.browser }}" = "firefox" ]; then
            yarn build:firefox:all:self-sign
          fi

      - name: Archive Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.artifact-prefix }}-${{ matrix.browser}}
          path: |
            dist/
            build/
          if-no-files-found: error
          retention-days: 7

  github-release:
    name: Create Github Release
    environment: release
    runs-on: ubuntu-latest
    if: needs.release-metadata.outputs.should-release == 'true'
    needs:
      - release-metadata
      - build
    outputs:
      release-id: ${{ steps.create-release.outputs.id }}

    steps:
      - uses: actions/checkout@v4

      - name: Download All Artifacts
        id: artifact
        uses: actions/download-artifact@v7
        with:
          pattern: ${{ env.artifact-prefix }}-*
          path: ${{ github.workspace }}/artifacts
          merge-multiple: true

      - name: Create Repository Release
        id: create-release
        uses: ncipollo/release-action@v1
        with:
          name: 'TwitterMediaHarvest ${{ needs.release-metadata.outputs.version-tag }}'
          artifacts: ${{ format('{0}/dist/*.zip,{0}/dist/*.xpi', steps.artifact.outputs.download-path) }}
          token: ${{ secrets.GITHUB_TOKEN }}
          body: ${{ needs.release-metadata.outputs.changelog }}
          tag: ${{ needs.release-metadata.outputs.version-tag }}

      - name: Rollback Release
        if: failure() && steps.create-release.outputs.id != ''
        uses: author/action-rollback@stable
        with:
          release_id: ${{ steps.create-release.outputs.id }}
          tag: ${{ needs.release-metadata.outputs.version-tag }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  sentry-release:
    name: Create Sentry Release
    environment: release
    runs-on: ubuntu-latest
    if: needs.release-metadata.outputs.should-release == 'true'
    needs:
      - release-metadata
      - build
      - github-release
    strategy:
      matrix:
        target: ['chrome', 'edge', 'firefox']

    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4.4.0
        with:
          node-version: '22.x'

      - name: Make release name
        id: release-name
        run: |
          echo "name=$(node ./utils/make-release-name.mjs --browser=${{ matrix.target }})" >> $GITHUB_OUTPUT

      - name: Download Artifact
        id: download-artifact
        uses: actions/download-artifact@v7
        with:
          name: ${{ env.artifact-prefix }}-${{ matrix.target }}

      - name: Create Sentry release for ${{ matrix.target }}
        uses: getsentry/action-release@v1
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
          # SENTRY_URL: https://sentry.io/
        with:
          version: ${{ steps.release-name.outputs.name }}
          url_prefix: '~/'
          environment: production
          sourcemaps: ${{ format('{0}/build/{1}', steps.download-artifact.outputs.download-path, matrix.target) }}

  chrome_release:
    name: Release to Chrome Web Store
    environment: release
    runs-on: ubuntu-latest
    if: needs.release-metadata.outputs.should-release == 'true'
    needs:
      - release-metadata
      - build
      - github-release
      - sentry-release

    steps:
      - uses: actions/checkout@v4

      - name: Download Artifact
        id: download-artifact
        uses: actions/download-artifact@v7
        with:
          name: ${{ env.artifact-prefix }}-chrome

      - name: Get file path
        id: get_filepath
        run: |
          echo "zip_file=$(ls ${{ steps.download-artifact.outputs.download-path }}/dist/*chrome*)" >> $GITHUB_OUTPUT

      - name: Publish to Chrome Web Store
        uses: mobilefirstllc/cws-publish@latest
        with:
          action: 'publish'
          client_id: ${{ secrets.CWS_CLIENT }}
          client_secret: ${{ secrets.CWS_SECRET }}
          refresh_token: ${{ secrets.CWS_TOKEN }}
          extension_id: hpcgabhdlnapolkkjpejieegfpehfdok
          zip_file: ${{ steps.get_filepath.outputs.zip_file }}

  xpi-release:
    name: XPI Release
    runs-on: ubuntu-latest
    environment: release
    if: needs.release-metadata.outputs.should-release == 'true'
    needs:
      - release-metadata
      - build
      - github-release
      - sentry-release

    env:
      XPI_NAME: ${{ vars.FF_ADDON_ID_SELF_SIGN }}-${{ needs.release-metadata.outputs.version-tag }}.xpi

    steps:
      - uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22.x'
          cache: 'yarn'
          cache-dependency-path: '**/yarn.lock' # Cache all workspaces' yarn.lock

      - name: Download Artifact
        id: artifact
        uses: actions/download-artifact@v7
        with:
          name: ${{ env.artifact-prefix }}-firefox

      - name: Sign Firefox xpi
        continue-on-error: true
        run: |
          npx web-ext sign \
            -s ${{ steps.artifact.outputs.download-path }}/build/firefox-signed \
            -a dist \
            --ignore-files "*.map" \
            --channel unlisted \
            --api-key ${{ secrets.FF_JWT_ISSUER }} \
            --api-secret ${{ secrets.FF_JWT_SECRET }}

          mv dist/*.xpi dist/${{ env.XPI_NAME }}

      - name: Upload files to a GitHub release
        id: upload-xpi
        uses: svenstaro/upload-release-action@v2
        with:
          file: dist/${{ env.XPI_NAME }}
          asset_name: ${{ env.XPI_NAME }}
          release_id: ${{ needs.github-release.outputs.release-id }}

      - name: Create Gecko Release
        uses: ./.github/actions/create-gecko-release
        with:
          id: ${{ vars.FF_ADDON_ID_SELF_SIGN }}
          version: ${{ needs.release-metadata.outputs.version }}
          url: ${{ steps.upload-xpi.outputs.browser_download_url }}
          min-browser-version: '111.0' # TODO: This should be parsed from browserlist config
          endpoint: ${{ secrets.GECKO_RELEASE_ENDPOINT }}
          api-key: ${{ secrets.RELEASE_API_KEY }}

  edge_release:
    name: Release to Edge Add-ons Store
    runs-on: ubuntu-latest
    environment: release
    if: needs.release-metadata.outputs.should-release == 'true'
    needs:
      - release-metadata
      - build
      - github-release
      - sentry-release

    steps:
      - uses: actions/checkout@v4

      - name: Download Artifact
        id: download-artifact
        uses: actions/download-artifact@v7
        with:
          name: ${{ env.artifact-prefix }}-edge

      - name: Get file path
        id: get-filepath
        run: |
          echo "zip_file=$(ls ${{ steps.download-artifact.outputs.download-path }}/dist/*edge*)" >> $GITHUB_OUTPUT

      - name: Upload to Edge Add-ons Store
        uses: wdzeng/edge-addon@v2
        with:
          product-id: ${{ secrets.MS_STORE_PRODUCT_ID }}
          client-id: ${{ secrets.MS_STORE_CLIENT_ID }}
          api-key: ${{ secrets.MS_STORE_API_KEY }}
          zip-path: ${{ steps.get-filepath.outputs.zip_file }}