on-release-published.yml

name: 🌍 Release
run-name: Release ${{ github.ref_name }}

on:
  workflow_dispatch:
  release:
    types: [published]

permissions:
  contents: write
  pages: write
  id-token: write

concurrency:
  group: release-publish-${{ github.ref_name }}
  cancel-in-progress: false

jobs:
  deploy-website:
    runs-on: ubuntu-latest
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - name: Checkout released ref
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.release.tag_name || github.ref_name }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: npm
          cache-dependency-path: website/package-lock.json

      - name: Install website dependencies
        run: |
          cd website
          npm ci

      - name: Build website
        env:
          FSCRIPT_DOCS_LAST_VERSION: ${{ github.event.release.tag_name || github.ref_name || 'current' }}
        run: |
          cd website
          npm run build

      - name: Configure GitHub Pages
        uses: actions/configure-pages@v5

      - name: Upload Pages artifact
        uses: actions/upload-pages-artifact@v4
        with:
          path: website/build

      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@v4

  release-nuget:
    runs-on: ubuntu-latest
    steps:
      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: 10.0.201

      - name: Download GitHub release artifacts
        uses: robinraju/release-downloader@v1.11
        with:
          tag: ${{ github.ref_name }}
          fileName: '*.nupkg'

      - name: Push packages to NuGet
        run: |
          shopt -s nullglob
          for pkg in ./*.nupkg; do
            dotnet nuget push "$pkg" --skip-duplicate --api-key "${{ secrets.NUGET_KEY }}" --source https://api.nuget.org/v3/index.json
          done

  publish-vscode-marketplace:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'

      - name: Download VSIX artifact
        uses: robinraju/release-downloader@v1.11
        with:
          tag: ${{ github.ref_name }}
          fileName: '*.vsix'

      - name: Install VS Code publishing tool
        run: npm install -g @vscode/vsce@3.5

      - name: Publish to VS Code Marketplace
        shell: bash
        env:
          VSCE_TOKEN: ${{ secrets.VSCE_TOKEN }}
        run: ./.github/scripts/publish-vscode-marketplace.sh

  publish-open-vsx:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'

      - name: Download VSIX artifact
        uses: robinraju/release-downloader@v1.11
        with:
          tag: ${{ github.ref_name }}
          fileName: '*.vsix'

      - name: Install Open VSX publishing tool
        run: npm install -g ovsx@0.9

      - name: Publish to Open VSX
        shell: bash
        env:
          OPEN_VSX_TOKEN: ${{ secrets.OPEN_VSX_TOKEN }}
        run: ./.github/scripts/publish-open-vsx.sh

  sign-and-notarize:
    runs-on: macos-latest
    steps:
      - name: Download unsigned macOS artifacts
        uses: robinraju/release-downloader@v1.11
        with:
          tag: ${{ github.ref_name }}
          fileName: 'fscript-*-darwin-unsigned.zip'

      - name: Extract binaries
        run: |
          mkdir -p .out/darwin
          unzip -d .out/darwin fscript-${{ github.ref_name }}-darwin-unsigned.zip
          test -f .out/darwin/entitlements.plist

      - name: Add cert to keychain
        uses: apple-actions/import-codesign-certs@v3
        with:
          p12-file-base64: ${{ secrets.MAC_CERT_BASE64 }}
          p12-password: ${{ secrets.MAC_CERT_PASSWORD }}

      - name: Sign binaries
        run: |
          codesign --force --timestamp --sign "Developer ID Application: Magnus Opera (${{ secrets.MAC_DEV_TEAM_ID }})" .out/darwin/arm64/fscript --options=runtime --no-strict --entitlements .out/darwin/entitlements.plist --identifier "${{ secrets.MAC_CERT_BUNDLE_ID }}.arm64"
          codesign --force --timestamp --sign "Developer ID Application: Magnus Opera (${{ secrets.MAC_DEV_TEAM_ID }})" .out/darwin/x64/fscript --options=runtime --no-strict --entitlements .out/darwin/entitlements.plist --identifier "${{ secrets.MAC_CERT_BUNDLE_ID }}.x64"
          (cd .out/darwin/arm64; zip ../fscript-${{ github.ref_name }}-darwin-arm64.zip ./*)
          (cd .out/darwin/x64; zip ../fscript-${{ github.ref_name }}-darwin-x64.zip ./*)

      - name: Notarize arm64
        uses: GuillaumeFalourd/notary-tools@v1
        timeout-minutes: 10
        with:
          product_path: '.out/darwin/fscript-${{ github.ref_name }}-darwin-arm64.zip'
          apple_id: ${{ secrets.MAC_DEV_LOGIN }}
          password: ${{ secrets.MAC_DEV_PASSWORD }}
          team_id: ${{ secrets.MAC_DEV_TEAM_ID }}
          xcode_path: '/Applications/Xcode_16.4.app'
          staple: false

      - name: Notarize x64
        uses: GuillaumeFalourd/notary-tools@v1
        timeout-minutes: 10
        with:
          product_path: '.out/darwin/fscript-${{ github.ref_name }}-darwin-x64.zip'
          apple_id: ${{ secrets.MAC_DEV_LOGIN }}
          password: ${{ secrets.MAC_DEV_PASSWORD }}
          team_id: ${{ secrets.MAC_DEV_TEAM_ID }}
          xcode_path: '/Applications/Xcode_16.4.app'
          staple: false

      - name: Upload signed macOS artifacts
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ github.ref_name }}
          files: |
            .out/darwin/fscript-${{ github.ref_name }}-darwin-arm64.zip
            .out/darwin/fscript-${{ github.ref_name }}-darwin-x64.zip

      - name: Remove unsigned macOS artifact
        continue-on-error: true
        uses: actions/github-script@v7
        with:
          script: |
            try {
              const tag = context.ref.replace('refs/tags/', '');
              const unsignedName = `fscript-${tag}-darwin-unsigned.zip`;
              const { data: release } = await github.rest.repos.getReleaseByTag({
                owner: context.repo.owner,
                repo: context.repo.repo,
                tag,
              });
              const asset = release.assets.find(a => a.name === unsignedName);
              if (!asset) {
                core.info(`Unsigned artifact not found: ${unsignedName}`);
                return;
              }
              await github.rest.repos.deleteReleaseAsset({
                owner: context.repo.owner,
                repo: context.repo.repo,
                asset_id: asset.id,
              });
              core.info(`Deleted unsigned artifact: ${unsignedName}`);
            } catch (error) {
              core.warning(`Best-effort cleanup failed: ${error?.message ?? error}`);
            }

  update-homebrew-tap:
    uses: ./.github/workflows/release-homebrew-tap.yml
    needs:
      - sign-and-notarize
    with:
      ref: ${{ github.ref }}
      version: ${{ github.ref_name }}
      dry-run: false
    secrets: inherit