🚀 Release #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 🚀 Release | |
| on: | |
| workflow_dispatch: | |
| env: | |
| NODE_VERSION: 22 | |
| jobs: | |
| release: | |
| name: Release | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Verify main branch | |
| run: | | |
| if [[ "${{ github.ref_name }}" != "main" ]]; then | |
| echo "Release can only be done on the main branch." | |
| exit 1 | |
| fi | |
| - name: Checkout project | |
| uses: actions/checkout@v4 | |
| # No `version` input: pnpm/action-setup reads the `packageManager` field | |
| # from package.json, so CI and local builds cannot drift apart. | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: pnpm | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Build package | |
| run: pnpm build | |
| # The key is passed through the environment rather than interpolated into | |
| # the script body, so it is never materialised in the rendered command. | |
| - name: Sign package | |
| working-directory: dist | |
| env: | |
| PRIVATE_KEY: ${{ secrets.PRIVATE_KEY }} | |
| run: | | |
| if [[ -z "$PRIVATE_KEY" ]]; then | |
| echo "Set an ed25519 key as PRIVATE_KEY in GitHub Action secrets to sign." | |
| exit 1 | |
| fi | |
| printf '%s\n' "$PRIVATE_KEY" > private_key.pem | |
| openssl pkeyutl -sign -inkey private_key.pem -out plugin_package.zip.sig -rawin -in plugin_package.zip | |
| rm private_key.pem | |
| openssl pkey -in <(printf '%s\n' "$PRIVATE_KEY") -pubout -out public_key.pem | |
| openssl pkeyutl -verify -pubin -inkey public_key.pem -rawin -in plugin_package.zip -sigfile plugin_package.zip.sig | |
| rm public_key.pem | |
| - name: Check version | |
| id: meta | |
| working-directory: dist | |
| run: | | |
| VERSION=$(unzip -p plugin_package.zip manifest.json | jq -r .version) | |
| echo "version=${VERSION}" >> $GITHUB_OUTPUT | |
| - name: Create release | |
| uses: caido/action-release@v1 | |
| with: | |
| tag: ${{ steps.meta.outputs.version }} | |
| commit: ${{ github.sha }} | |
| body: "Release ${{ steps.meta.outputs.version }}" | |
| artifacts: "dist/plugin_package.zip,dist/plugin_package.zip.sig" | |
| immutableCreate: true |