beta-release.yml

# .github/workflows/beta-release.yml

name: "Automatic Beta Release on PR Commit"

on:
    pull_request:
        # Trigger on PR creation or when new commits are pushed
        types: [opened, synchronize]
        # IMPORTANT: Change 'main' to your default branch if it's different (e.g., 'master')
        branches:
            - master
    push:
        # Only trigger on push to specific branches (more secure)
        branches:
            - master
            - "feat/**"
            - "release/**"

env:
    PLUGIN_NAME: obsidian-task-genius

# Grant permissions for the action to create a release
permissions:
    contents: write
    pull-requests: read

jobs:
    build-and-release-beta:
        if: |
            contains(github.event.head_commit.message, '[release-beta]') && (
              (github.event_name == 'push' && github.actor == github.repository_owner) ||
              (github.event_name == 'pull_request' && github.event.pull_request.author_association == 'OWNER')
            )
        runs-on: ubuntu-latest
        steps:
            - name: "Checkout code"
              uses: actions/checkout@v4
              with:
                  fetch-depth: 0

            # Check if any recent commits contain [release-beta] tag
            - name: "Check for release-beta tag in commits"
              id: check_release_tag
              run: |
                  SHOULD_RELEASE="false"

                  # Security check: only allow releases from the main repository
                  REPO_OWNER="${{ github.repository_owner }}"
                  REPO_NAME="${{ github.repository }}"
                  echo "Repository: $REPO_NAME, Owner: $REPO_OWNER"

                  # Add your expected repository info here for extra security
                  # EXPECTED_REPO="your-username/your-repo-name"
                  # if [ "$REPO_NAME" != "$EXPECTED_REPO" ]; then
                  #   echo "Release not allowed from repository: $REPO_NAME"
                  #   echo "SHOULD_RELEASE=false" >> $GITHUB_OUTPUT
                  #   exit 0
                  # fi

                  if [ "${{ github.event_name }}" = "pull_request" ]; then
                    echo "Checking PR commits for [release-beta] tag..."
                    # Check the latest commit in the PR
                    LATEST_COMMIT_MSG=$(git log -1 --pretty=format:"%s")
                    echo "Latest commit message: $LATEST_COMMIT_MSG"
                    
                    if echo "$LATEST_COMMIT_MSG" | grep -q "\[release-beta\]"; then
                      echo "Found [release-beta] tag in latest commit"
                      SHOULD_RELEASE="true"
                    fi
                    
                    # Check user permissions (more restrictive)
                    USER_ASSOCIATION="${{ github.event.pull_request.author_association }}"
                    PR_AUTHOR="${{ github.event.pull_request.user.login }}"
                    echo "PR author: $PR_AUTHOR, Association: $USER_ASSOCIATION"
                    
                    # Only allow OWNER and COLLABORATOR to trigger releases
                    if [ "$USER_ASSOCIATION" != "OWNER" ] && [ "$USER_ASSOCIATION" != "COLLABORATOR" ]; then
                      echo "User association '$USER_ASSOCIATION' is not authorized for releases"
                      SHOULD_RELEASE="false"
                    fi
                    
                    # Additional check: only allow specific users (optional - uncomment and customize)
                    # ALLOWED_USERS="Quorafind,other-username"
                    # if ! echo "$ALLOWED_USERS" | grep -q "$PR_AUTHOR"; then
                    #   echo "User '$PR_AUTHOR' is not in allowed users list"
                    #   SHOULD_RELEASE="false"
                    # fi
                    
                  elif [ "${{ github.event_name }}" = "push" ]; then
                    echo "Checking push commit for [release-beta] tag..."
                    COMMIT_MSG="${{ github.event.head_commit.message }}"
                    PUSH_AUTHOR="${{ github.event.head_commit.author.username }}"
                    echo "Commit message: $COMMIT_MSG"
                    echo "Push author: $PUSH_AUTHOR"
                    
                    if echo "$COMMIT_MSG" | grep -q "\[release-beta\]"; then
                      echo "Found [release-beta] tag in push commit"
                      
                      # Check if pusher is authorized (optional - uncomment and customize)
                      # ALLOWED_PUSH_USERS="Quorafind,other-username"
                      # if ! echo "$ALLOWED_PUSH_USERS" | grep -q "$PUSH_AUTHOR"; then
                      #   echo "User '$PUSH_AUTHOR' is not authorized to trigger releases via push"
                      #   SHOULD_RELEASE="false"
                      # else
                      #   SHOULD_RELEASE="true"
                      # fi
                      
                      SHOULD_RELEASE="true"
                    fi
                  fi

                  echo "SHOULD_RELEASE=$SHOULD_RELEASE" >> $GITHUB_OUTPUT
                  echo "Should release: $SHOULD_RELEASE"

            - name: "Use Node.js 22"
              if: steps.check_release_tag.outputs.SHOULD_RELEASE == 'true'
              uses: actions/setup-node@v4
              with:
                  node-version: 22

            - name: "Install pnpm"
              if: steps.check_release_tag.outputs.SHOULD_RELEASE == 'true'
              uses: pnpm/action-setup@v4
              with:
                  version: 9

            - name: "Install dependencies"
              if: steps.check_release_tag.outputs.SHOULD_RELEASE == 'true'
              run: |
                  # Install jq for JSON parsing
                  sudo apt-get update && sudo apt-get install -y jq
                  pnpm install

            - name: "Get version from package.json"
              if: steps.check_release_tag.outputs.SHOULD_RELEASE == 'true'
              id: get_version
              run: echo "VERSION=$(node -p "require('./package.json').version")" >> $GITHUB_ENV

            - name: "Get commit messages since last release"
              if: steps.check_release_tag.outputs.SHOULD_RELEASE == 'true'
              id: get_commits
              run: |
                  # Get all releases (including pre-releases) and find the most recent one
                  echo "Fetching all releases from GitHub API..."
                  LAST_RELEASE=$(curl -s "https://api.github.com/repos/${{ github.repository }}/releases?per_page=100" | jq -r '.[0].tag_name // empty' 2>/dev/null || echo "")
                  
                  # If no release found via API, try to get the most recent tag with proper semantic version sorting
                  if [ -z "$LAST_RELEASE" ]; then
                    echo "No release found via API, looking for latest tag..."
                    # Get all tags and sort them properly using semantic versioning
                    LAST_RELEASE=$(git tag -l | grep -E '^v?[0-9]+\.[0-9]+\.[0-9]+' | sort -V | tail -n 1 2>/dev/null || echo "")
                  fi
                  
                  if [ -z "$LAST_RELEASE" ]; then
                    echo "No previous release or tag found, getting all commits from the beginning"
                    COMMIT_MESSAGES=$(git log --pretty=format:"- %s (%an) [%h](https://github.com/${{ github.repository }}/commit/%H)" --no-merges)
                    LAST_RELEASE="(initial)"
                  else
                    echo "Getting commits since last release: $LAST_RELEASE"
                    RELEASE_COMMIT=$(git rev-list -n 1 $LAST_RELEASE 2>/dev/null || git rev-list -n 1 HEAD~10)
                    COMMIT_MESSAGES=$(git log ${RELEASE_COMMIT}..HEAD --pretty=format:"- %s (%an) [%h](https://github.com/${{ github.repository }}/commit/%H)" --no-merges)
                  fi
                  
                  if [ -z "$COMMIT_MESSAGES" ]; then
                    COMMIT_MESSAGES="- No new commits since last release"
                  fi
                  echo "COMMIT_MESSAGES<<EOF" >> $GITHUB_ENV
                  echo "$COMMIT_MESSAGES" >> $GITHUB_ENV
                  echo "EOF" >> $GITHUB_ENV
                  echo "LAST_RELEASE=$LAST_RELEASE" >> $GITHUB_ENV

            - name: "Build and package plugin"
              if: steps.check_release_tag.outputs.SHOULD_RELEASE == 'true'
              id: build
              run: |
                  pnpm run build
                  mkdir ${{ env.PLUGIN_NAME }}
                  cp main.js manifest.json styles.css ${{ env.PLUGIN_NAME }}/
                  zip -r ${{ env.PLUGIN_NAME }}-${{ env.VERSION }}.zip ./${{ env.PLUGIN_NAME }}

            - name: "Create Beta Pre-Release"
              if: steps.check_release_tag.outputs.SHOULD_RELEASE == 'true'
              uses: softprops/action-gh-release@v2
              with:
                  body: |
                      ${{ github.event_name == 'pull_request' && format('🚀 Automated beta release for PR #{0}', github.event.pull_request.number) || '🚀 Automated beta release' }}

                      ## 📝 Changes since last release${{ env.LAST_RELEASE && format(' ({0})', env.LAST_RELEASE) || '' }}:

                      ${{ env.COMMIT_MESSAGES }}

                      ---

                      ${{ github.event_name == 'pull_request' && github.event.pull_request.body || '' }}
                  prerelease: true
                  tag_name: "v${{ env.VERSION }}"
                  name: "Beta Release v${{ env.VERSION }}"
                  files: |
                      ${{ env.PLUGIN_NAME }}-${{ env.VERSION }}.zip
                      main.js
                      manifest.json
                      styles.css