release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version number (e.g. 1.0.0 — must match manifest.json)'
        required: true
        default: '1.0.0'

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
      attestations: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install dependencies
        run: |
          rm -f package-lock.json
          rm -rf node_modules
          npm install --no-audit --no-fund
          npm install @rollup/rollup-linux-x64-gnu --no-audit --no-fund --no-save

      - name: Build plugin
        run: node esbuild.config.mjs production

      - name: Collect release assets
        run: |
          mkdir -p release-assets
          cp main.js manifest.json styles.css release-assets/

          # Optional assets (Phase 2) -- downloaded on demand by users
          # via Settings, never auto-installed. Published to a SEPARATE
          # release tag (${version}-assets) so the main plugin release
          # contains only the three files Obsidian itself supports
          # (main.js, manifest.json, styles.css). Keeping them on a
          # separate tag avoids confusing the Community Plugin review
          # bot's "extra files in release" recommendation while still
          # giving OptionalAssetManager a stable per-version URL.
          mkdir -p optional-assets
          if [ -f "node_modules/onnxruntime-web/dist/ort-wasm-simd-threaded.wasm" ]; then
            cp node_modules/onnxruntime-web/dist/ort-wasm-simd-threaded.wasm optional-assets/
          fi
          if [ -f "plugin-source.json" ]; then
            cp plugin-source.json optional-assets/
          fi
          if [ -f "office-bundle.js" ]; then
            cp office-bundle.js optional-assets/
          fi
          if [ -f "pdfjs-bundle.js" ]; then
            cp pdfjs-bundle.js optional-assets/
          fi

          echo "=== Plugin release assets ==="
          ls -lh release-assets/
          echo "=== Optional assets (separate tag) ==="
          ls -lh optional-assets/

      - name: Verify build output
        run: |
          ls -lh release-assets/main.js release-assets/manifest.json release-assets/styles.css
          echo "manifest version: $(jq -r .version release-assets/manifest.json)"
          echo "Optional assets:"
          for f in ort-wasm-simd-threaded.wasm plugin-source.json office-bundle.js pdfjs-bundle.js; do
            if [ -f "optional-assets/$f" ]; then
              echo "  $f  $(ls -lh optional-assets/$f | awk '{print $5}')  sha256=$(shasum -a 256 optional-assets/$f | cut -d' ' -f1)"
            fi
          done

      - name: Generate build provenance attestation
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: |
            release-assets/main.js
            release-assets/styles.css
            optional-assets/ort-wasm-simd-threaded.wasm
            optional-assets/plugin-source.json
            optional-assets/office-bundle.js
            optional-assets/pdfjs-bundle.js

      # IMPORTANT: order matters. The Obsidian community plugin crawler
       # walks the GitHub releases list and matches the manifest.json
       # `version` against the latest release tag. If `${version}-assets`
       # is published AFTER `${version}`, GitHub orders it as the most
       # recent release and Obsidian fails to match (the crawler sees
       # `-assets` on top, doesn't find that string in manifest.json,
       # and stops). Fix: publish `-assets` FIRST, then the manifest-
       # matching release, and pin `make_latest` explicitly so the
       # behaviour doesn't depend on creation order.
      - name: Create GitHub Release (optional assets)
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ inputs.version }}-assets
          name: ${{ inputs.version }} -- Optional assets
          make_latest: 'false'
          body: |
            Optional assets for Vault Operator v${{ inputs.version }}.

            These files are downloaded on demand by the plugin only after
            an explicit user click in Settings:

            - `ort-wasm-simd-threaded.wasm` -- semantic reranker (~12 MB)
            - `plugin-source.json` -- self-development source bundle (~5 MB)
            - `office-bundle.js` -- exceljs + docx + pptxgenjs (~1.7 MB)
            - `pdfjs-bundle.js` -- pdfjs-dist + worker (~1.6 MB)

            They are NOT part of the plugin's main release tag so the
            Obsidian plugin installer never sees them. SHA-256 hashes are
            pinned in the plugin code (`assetHashes.ts`) and verified
            before any file is persisted.
          files: |
            optional-assets/ort-wasm-simd-threaded.wasm
            optional-assets/plugin-source.json
            optional-assets/office-bundle.js
            optional-assets/pdfjs-bundle.js
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Create GitHub Release (plugin)
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ inputs.version }}
          name: ${{ inputs.version }}
          make_latest: 'true'
          body: |
            ## Vault Operator v${{ inputs.version }}

            Install via [BRAT](https://github.com/TfTHacker/obsidian42-brat):
            1. Install BRAT from Community Plugins
            2. BRAT → Add Beta Plugin → `https://github.com/pssah4/vault-operator`

            Or install manually:
            1. Download `main.js`, `manifest.json`, `styles.css` into `.obsidian/plugins/vault-operator/`
            2. Reload Obsidian

            ### Optional assets
            Four optional downloads (semantic reranker, self-development source
            bundle, office document support, PDF parser) are published as a
            separate tag `${{ inputs.version }}-assets` and installed on demand
            from the plugin's Settings, never silently. The plugin works
            without any of them; the affected tool reports "not installed"
            until you click Install.
          files: |
            release-assets/main.js
            release-assets/manifest.json
            release-assets/styles.css
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}