release.yml

name: Create Release

on:
  # Start after quality checks finish, rather than racing them on the same push.
  # The job below runs only for a successful run of this repository's own push or manual
  # dispatch on the main branch, and checks out the commit that run tested.
  workflow_run:  # zizmor: ignore[dangerous-triggers]
    workflows: [ "WordPress Compatibility & Plugin Check" ]
    types: [ completed ]
    branches: [ main, master ]
  # Allow manual triggering.
  workflow_dispatch:

permissions:
  contents: write
  actions: read

concurrency:
  group: release-${{ github.event.workflow_run.head_branch || github.ref_name }}
  cancel-in-progress: false

env:
  PLUGIN_SLUG: enginescript-site-optimizer

jobs:
  check-and-release:
    if: >-
      (github.event_name == 'workflow_dispatch' &&
       (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master')) ||
      (github.event_name == 'workflow_run' &&
       github.event.workflow_run.conclusion == 'success' &&
       github.event.workflow_run.head_repository.full_name == github.repository &&
       (github.event.workflow_run.event == 'push' || github.event.workflow_run.event == 'workflow_dispatch') &&
       (github.event.workflow_run.head_branch == 'main' || github.event.workflow_run.head_branch == 'master'))
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      # workflow_run's github.sha is the default-branch tip, not necessarily the tested commit.
      RELEASE_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
      RELEASE_BRANCH: ${{ github.event.workflow_run.head_branch || github.ref_name }}
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false
          ref: ${{ env.RELEASE_SHA }}
          fetch-depth: 0

      - name: Get latest version
        id: get_version
        run: |
          PLUGIN_FILE="${PLUGIN_SLUG}.php"
          VERSION=$(grep -oP "Version: \K[0-9]+\.[0-9]+\.[0-9]+" "$PLUGIN_FILE")
          [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Found version: $VERSION"

      - name: Check if release exists
        id: check_release
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ steps.get_version.outputs.version }}
        run: |
          # Transport/auth/rate-limit/server failures must never authorize publication.
          RELEASE_STATUS=$(curl --silent --show-error --proto '=https' \
            --connect-timeout 20 --max-time 60 \
            --header "Authorization: Bearer $GH_TOKEN" \
            --header 'Accept: application/vnd.github+json' \
            --output /dev/null --write-out '%{http_code}' \
            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/releases/tags/v$VERSION")
          case "$RELEASE_STATUS" in
            200) echo 'exists=true' >> "$GITHUB_OUTPUT" ;;
            404) echo 'exists=false' >> "$GITHUB_OUTPUT" ;;
            *) echo "::error::Release lookup failed (HTTP $RELEASE_STATUS)."; exit 1 ;;
          esac

      - name: Require successful quality checks for this commit
        if: steps.check_release.outputs.exists == 'false'
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ steps.get_version.outputs.version }}
        run: |
          # Automatic releases start after quality succeeds; manual runs must also
          # prove every gate for the exact commit checked out above.
          gh api --method GET \
            "repos/$GITHUB_REPOSITORY/actions/workflows/wp-compatibility-test.yml/runs" \
            -f head_sha="$RELEASE_SHA" -f branch="$RELEASE_BRANCH" -f per_page=100 \
            > "$RUNNER_TEMP/quality-runs.json"
          if ! RUN_ID=$(jq -er --arg sha "$RELEASE_SHA" --arg repo "$GITHUB_REPOSITORY" \
            --arg branch "$RELEASE_BRANCH" '
            [.workflow_runs[] | select(.head_sha == $sha and .head_branch == $branch
              and .head_repository.full_name == $repo
              and (.event == "push" or .event == "workflow_dispatch"))]
            | sort_by(.id) | last
            | select(.status == "completed" and .conclusion == "success") | .id
            ' "$RUNNER_TEMP/quality-runs.json"); then
            echo "::error::No completed successful compatibility run for commit $RELEASE_SHA on $RELEASE_BRANCH. Check WordPress Compatibility & Plugin Check before rerunning a manual release."
            exit 1
          fi
          gh api --paginate --slurp \
            "repos/$GITHUB_REPOSITORY/actions/runs/$RUN_ID/jobs?filter=latest&per_page=100" \
            > "$RUNNER_TEMP/quality-jobs.json"
          # A successful workflow with a skipped/missing gate is insufficient.
          if ! jq -e '
            ["WP Plugin Check (PHP 8.3)", "PHPCS (PHP 8.3)", "WP VIP CS (PHP 8.3)",
             "PHPMD (PHP 8.3)", "Psalm Static Analysis (PHP 8.3)",
             "Security Scan (PHP 8.3)", "PHPStan for WP (PHP 8.3)",
             "Lint (Node 24)", "Unit Test Coverage (PHP 8.4)",
             ( ["8.2", "8.3", "8.4", "8.5"][] as $php |
               ["7.0", "latest", "nightly"][] as $wp |
               "Test WordPress \($wp) with PHP \($php) (highest deps)" ),
             "Test WordPress latest with PHP 8.2 (lowest deps)"] as $expected
            | [.[].jobs[]] as $jobs
            | all($expected[]; . as $name |
                ([$jobs[] | select(.name == $name)] | length) == 1 and
                any($jobs[]; .name == $name and .status == "completed" and .conclusion == "success"))
            ' "$RUNNER_TEMP/quality-jobs.json"; then
            echo "::error::Quality run $RUN_ID has a missing, duplicate, unfinished or unsuccessful required job."
            exit 1
          fi
          if git rev-parse --verify "refs/tags/v$VERSION" >/dev/null 2>&1; then
            if [[ $(git rev-parse "refs/tags/v$VERSION^{commit}") != "$RELEASE_SHA" ]]; then
              echo "::error::Tag v$VERSION already points to a different commit."
              exit 1
            fi
          fi
          echo "Quality evidence: $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$RUN_ID" \
            >> "$GITHUB_STEP_SUMMARY"

      - name: Update README version
        if: steps.check_release.outputs.exists == 'false'
        env:
          VERSION: ${{ steps.get_version.outputs.version }}
        run: |
          README_FILE="README.md"
          TMP_FILE=$(mktemp)

          # Update the version badge with the new version and logo
          sed -E "s#\[!\[Version\]\(https://img\.shields\.io/badge/Version-[0-9]+\.[0-9]+\.[0-9]+-orange\.svg\?logo=github\)\]\(https://github\.com/[^/]+/${PLUGIN_SLUG}/releases/(latest/download|download/v[0-9]+\.[0-9]+\.[0-9]+)/${PLUGIN_SLUG}-[0-9]+\.[0-9]+\.[0-9]+\.zip\)#[![Version](https://img.shields.io/badge/Version-${VERSION}-orange.svg?logo=github)](https://github.com/${{ github.repository }}/releases/latest/download/${PLUGIN_SLUG}-${VERSION}.zip)#g" "$README_FILE" > "$TMP_FILE"

          # Publication must use the reviewed commit, not a new untested bot commit.
          if ! cmp -s "$README_FILE" "$TMP_FILE"; then
            rm "$TMP_FILE"
            echo "::error::Update README.md version metadata in a reviewed commit before releasing."
            exit 1
          else
            echo "::notice::README.md already has the correct version"
          fi

          # Clean up temporary file
          rm "$TMP_FILE"

      - name: Create zip file
        if: steps.check_release.outputs.exists == 'false'
        env:
          VERSION: ${{ steps.get_version.outputs.version }}
        run: |
          PLUGIN_FILE="${PLUGIN_SLUG}.php"
          rm -rf "$PLUGIN_SLUG"
          mkdir -p "$PLUGIN_SLUG"
          cp "$PLUGIN_FILE" "$PLUGIN_SLUG/"
          cp uninstall.php "$PLUGIN_SLUG/"
          cp -r includes "$PLUGIN_SLUG/"
          cp readme.txt "$PLUGIN_SLUG/"
          cp LICENSE "$PLUGIN_SLUG/"
          cp -r languages "$PLUGIN_SLUG/"
          zip -r "${PLUGIN_SLUG}-${VERSION}.zip" "$PLUGIN_SLUG"
          python3 .github/scripts/check-plugin-package.py "$PLUGIN_SLUG" \
            --zip "${PLUGIN_SLUG}-${VERSION}.zip"

      - name: Get changelog entry
        if: steps.check_release.outputs.exists == 'false'
        id: get_changelog
        env:
          VERSION: ${{ steps.get_version.outputs.version }}
        run: |
          CHANGELOG_ENTRY=$(awk -v ver="$VERSION" 'BEGIN{flag=0; target="^## \\[?" ver "\\]?([[:space:]-]|$)"} $0 ~ target {flag=1; print; next} /^## \[?[0-9]+\.[0-9]+\.[0-9]+\]?([[:space:]-]|$)/ {flag=0} flag {print}' CHANGELOG.md | tail -n +2)
          {
            echo "changelog<<EOF"
            echo "$CHANGELOG_ENTRY"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      # softprops/action-gh-release attaches the archive and fails when the file is missing.
      - name: Create Release  # zizmor: ignore[superfluous-actions]
        if: steps.check_release.outputs.exists == 'false'
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64  # v3.0.3
        with:
          tag_name: v${{ steps.get_version.outputs.version }}
          target_commitish: ${{ env.RELEASE_SHA }}
          fail_on_unmatched_files: true
          name: Release v${{ steps.get_version.outputs.version }}
          body: |
            ${{ steps.get_changelog.outputs.changelog }}

            ## Installation
            1. Download the zip file
            2. Upload to your WordPress site through the Plugins > Add New > Upload menu
            3. Activate the plugin

            [Full Documentation](https://github.com/${{ github.repository }})
          files: ${{ env.PLUGIN_SLUG }}-${{ steps.get_version.outputs.version }}.zip
          draft: false
          prerelease: false
          generate_release_notes: false