|
| 1 | +name: Tag and release from CHANGELOG |
| 2 | + |
| 3 | +# Runs after each push to main. If CHANGELOG.md gained a new ## vX.Y.Z heading |
| 4 | +# anywhere in this push's commit range (compared to the push's `before` SHA): |
| 5 | +# 1. gate the release — the version in .claude-plugin/marketplace.json must |
| 6 | +# match the new heading, and the validator + test suite must pass |
| 7 | +# (the suite also asserts every plugin.json carries the same version), then |
| 8 | +# 2. create a lightweight tag with that version name at the pushed commit, and |
| 9 | +# 3. publish a GitHub Release for that tag with the matching CHANGELOG |
| 10 | +# section as the notes. |
| 11 | +# |
| 12 | +# CHANGELOG is the source of truth; the tag and the Release are deterministic |
| 13 | +# projections of it. Adapted from phuryn/claude-usage's tag-on-merge workflow, |
| 14 | +# minus the .vsix build. Added headings whose tag already exists are treated as |
| 15 | +# backfilled history and skipped, so importing old releases is safe. |
| 16 | +# |
| 17 | +# No action when CHANGELOG wasn't touched, when an existing version heading was |
| 18 | +# edited (not added), or when the tag/release already exists. Safe to re-run on |
| 19 | +# force-pushes and amends. |
| 20 | + |
| 21 | +on: |
| 22 | + push: |
| 23 | + branches: [main] |
| 24 | + |
| 25 | +permissions: |
| 26 | + contents: write |
| 27 | + |
| 28 | +jobs: |
| 29 | + release: |
| 30 | + runs-on: ubuntu-latest |
| 31 | + |
| 32 | + steps: |
| 33 | + - uses: actions/checkout@v5 |
| 34 | + with: |
| 35 | + # Need enough history to diff the whole push range (`before..after`), |
| 36 | + # not just the tip commit. Small repo; a full clone is cheap. |
| 37 | + fetch-depth: 0 |
| 38 | + |
| 39 | + - name: Detect new version heading in CHANGELOG |
| 40 | + id: detect |
| 41 | + env: |
| 42 | + BEFORE: ${{ github.event.before }} |
| 43 | + AFTER: ${{ github.sha }} |
| 44 | + run: | |
| 45 | + set -euo pipefail |
| 46 | +
|
| 47 | + # On a brand-new branch (first push), before is all zeros. |
| 48 | + zeros="0000000000000000000000000000000000000000" |
| 49 | + if [ "$BEFORE" = "$zeros" ] || [ -z "$BEFORE" ]; then |
| 50 | + echo "version=" >> "$GITHUB_OUTPUT" |
| 51 | + echo "Brand-new branch push; nothing to compare." |
| 52 | + exit 0 |
| 53 | + fi |
| 54 | +
|
| 55 | + # Lines added to CHANGELOG.md across the entire pushed range that |
| 56 | + # look like a version heading. Format: `## vX.Y.Z` (semver triplet |
| 57 | + # required). The trailing-boundary group prevents `## v2.1.0a` from |
| 58 | + # matching `v2.1.0`. |
| 59 | + added_versions=$(git diff "$BEFORE..$AFTER" -- CHANGELOG.md \ |
| 60 | + | grep -E '^\+## v[0-9]+\.[0-9]+\.[0-9]+([[:space:]]|$)' \ |
| 61 | + | sed -E 's/^\+## (v[0-9]+\.[0-9]+\.[0-9]+)([[:space:]]|$).*/\1/' \ |
| 62 | + || true) |
| 63 | +
|
| 64 | + if [ -z "$added_versions" ]; then |
| 65 | + echo "version=" >> "$GITHUB_OUTPUT" |
| 66 | + echo "No new ## vX.Y.Z heading added to CHANGELOG; nothing to tag." |
| 67 | + exit 0 |
| 68 | + fi |
| 69 | +
|
| 70 | + # Headings whose tag already exists on origin are backfilled history, |
| 71 | + # not new releases — skip them. |
| 72 | + new_versions="" |
| 73 | + for v in $added_versions; do |
| 74 | + if git ls-remote --tags origin "refs/tags/$v" | grep -q .; then |
| 75 | + echo "$v is already tagged; treating as backfill." |
| 76 | + else |
| 77 | + new_versions="${new_versions}${v}"$'\n' |
| 78 | + fi |
| 79 | + done |
| 80 | + new_versions=$(printf '%s' "$new_versions" | sed '/^$/d') |
| 81 | +
|
| 82 | + if [ -z "$new_versions" ]; then |
| 83 | + echo "version=" >> "$GITHUB_OUTPUT" |
| 84 | + echo "All added headings are already tagged (backfill); nothing to do." |
| 85 | + exit 0 |
| 86 | + fi |
| 87 | +
|
| 88 | + # If multiple new untagged headings were added in one push, fail |
| 89 | + # loudly — ambiguous which one to tag, and shipping two releases in |
| 90 | + # one merge is almost certainly not intended. |
| 91 | + count=$(echo "$new_versions" | wc -l) |
| 92 | + if [ "$count" -gt 1 ]; then |
| 93 | + echo "::error::Multiple new untagged version headings detected; refusing to auto-tag. Versions: $new_versions" |
| 94 | + exit 1 |
| 95 | + fi |
| 96 | +
|
| 97 | + version=$(echo "$new_versions" | head -1) |
| 98 | + echo "version=$version" >> "$GITHUB_OUTPUT" |
| 99 | + echo "Detected new release: $version" |
| 100 | +
|
| 101 | + # ── Release gates ──────────────────────────────────────────────────── |
| 102 | + # Everything below is gated on a new version being detected, so ordinary |
| 103 | + # pushes to main (docs, typo fixes) incur no setup or test cost. |
| 104 | + |
| 105 | + - name: "Gate: marketplace.json version matches the CHANGELOG" |
| 106 | + if: steps.detect.outputs.version != '' |
| 107 | + env: |
| 108 | + VERSION: ${{ steps.detect.outputs.version }} |
| 109 | + run: | |
| 110 | + set -euo pipefail |
| 111 | + want="${VERSION#v}" |
| 112 | + have=$(python3 -c "import json; print(json.load(open('.claude-plugin/marketplace.json'))['version'])") |
| 113 | + if [ "$have" != "$want" ]; then |
| 114 | + echo "::error::marketplace.json is $have but CHANGELOG released $VERSION. Bump the manifests before the release push." |
| 115 | + exit 1 |
| 116 | + fi |
| 117 | + echo "marketplace.json at $have." |
| 118 | +
|
| 119 | + - name: "Gate: validator + test suite" |
| 120 | + if: steps.detect.outputs.version != '' |
| 121 | + run: | |
| 122 | + set -euo pipefail |
| 123 | + python3 validate_plugins.py |
| 124 | + python3 -m unittest discover -s tests -v |
| 125 | +
|
| 126 | + - name: Create and push tag if it doesn't already exist |
| 127 | + if: steps.detect.outputs.version != '' |
| 128 | + env: |
| 129 | + VERSION: ${{ steps.detect.outputs.version }} |
| 130 | + run: | |
| 131 | + set -euo pipefail |
| 132 | +
|
| 133 | + # Tag may already exist if someone tagged manually before the |
| 134 | + # workflow caught up, or on a re-push of the same commit. Idempotent. |
| 135 | + if git ls-remote --tags origin "refs/tags/$VERSION" | grep -q .; then |
| 136 | + echo "Tag $VERSION already exists on origin; nothing to do." |
| 137 | + exit 0 |
| 138 | + fi |
| 139 | +
|
| 140 | + git tag "$VERSION" |
| 141 | + git push origin "$VERSION" |
| 142 | + echo "Tagged $VERSION at $(git rev-parse HEAD)." |
| 143 | +
|
| 144 | + - name: Create GitHub Release with the CHANGELOG section as notes |
| 145 | + if: steps.detect.outputs.version != '' |
| 146 | + env: |
| 147 | + VERSION: ${{ steps.detect.outputs.version }} |
| 148 | + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 149 | + run: | |
| 150 | + set -euo pipefail |
| 151 | +
|
| 152 | + # Idempotent: a re-push of the same release commit shouldn't error. |
| 153 | + if gh release view "$VERSION" >/dev/null 2>&1; then |
| 154 | + echo "Release $VERSION already exists; nothing to do." |
| 155 | + exit 0 |
| 156 | + fi |
| 157 | +
|
| 158 | + # Extract this version's CHANGELOG section (heading through the line |
| 159 | + # before the next `## vX` heading) as the release notes. $2 is the |
| 160 | + # version token: `## v2.1.0 — 2026-07-03` → $2 == "v2.1.0". |
| 161 | + notes="$(mktemp)" |
| 162 | + awk -v ver="$VERSION" ' |
| 163 | + /^## v[0-9]/ { if (started) exit; if ($2 == ver) started=1 } |
| 164 | + started { print } |
| 165 | + ' CHANGELOG.md > "$notes" |
| 166 | + if [ ! -s "$notes" ]; then |
| 167 | + echo "::error::No '## $VERSION' section found in CHANGELOG.md." |
| 168 | + exit 1 |
| 169 | + fi |
| 170 | +
|
| 171 | + gh release create "$VERSION" \ |
| 172 | + --title "$VERSION" \ |
| 173 | + --notes-file "$notes" |
| 174 | + echo "Released $VERSION." |
0 commit comments