release.yml

# Build and release a new version of the extension.
# Based on example workflow at https://github.com/actions/upload-release-asset
# licensed under https://github.com/actions/upload-release-asset/blob/master/LICENSE.
# Reference for passing data between steps:
# https://jasonet.co/posts/new-features-of-github-actions/#passing-data-to-future-steps

name: Release
on:
  workflow_dispatch:

  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+*'

jobs:
  build:
    name: Release
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version-file: extensions/ql-vscode/.nvmrc

      - name: Install dependencies
        run: |
          cd extensions/ql-vscode
          npm ci
        shell: bash

      - name: Build
        env:
          APP_INSIGHTS_KEY: '${{ secrets.APP_INSIGHTS_KEY }}'
        run: |
          echo "APP INSIGHTS KEY LENGTH: ${#APP_INSIGHTS_KEY}"
          cd extensions/ql-vscode
          npm run build -- --release
        shell: bash

      - name: Prepare artifacts
        id: prepare-artifacts
        run: |
          mkdir artifacts
          cp dist/*.vsix artifacts
          # Record the VSIX path as an output of this step.
          # This will be used later when uploading a release asset.
          VSIX_PATH="$(ls dist/*.vsix)"
          echo "vsix_path=$VSIX_PATH" >> "$GITHUB_OUTPUT"
          # Transform the GitHub ref so it can be used in a filename.
          # The last sed invocation is used for testing branches that modify this workflow.
          REF_NAME="$(echo ${{ github.ref }} | sed -e 's:^refs/tags/::' | sed -e 's:/:-:g')"
          echo "ref_name=$REF_NAME" >> "$GITHUB_OUTPUT"

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: vscode-codeql-extension
          path: artifacts

      - name: Upload source maps
        uses: actions/upload-artifact@v4
        with:
          name: vscode-codeql-sourcemaps
          path: dist/vscode-codeql/out/*.map

        # TODO Run tests, or check that a test run on the same branch succeeded.

      - name: Create sourcemap ZIP file
        run: |
          cd dist/vscode-codeql/out
          zip -r ../../vscode-codeql-sourcemaps.zip *.map

      - name: Create release
        id: create-release
        run: |
          gh release create ${{ github.ref_name }} --draft --title "Release ${{ github.ref_name }}" \
            '${{ steps.prepare-artifacts.outputs.vsix_path }}#${{ format('vscode-codeql-{0}.vsix', steps.prepare-artifacts.outputs.ref_name) }}' \
            'dist/vscode-codeql-sourcemaps.zip#${{ format('vscode-codeql-sourcemaps-{0}.zip', steps.prepare-artifacts.outputs.ref_name) }}'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      ###
      # Do Post release work: version bump and changelog PR
      # Only do this if we are running from a PR (ie- this is part of the release process)

      # The checkout action does not fetch the main branch.
      # Fetch the main branch so that we can base the version bump PR against main.
      - name: Fetch main branch
        run: |
          git fetch --depth=1 origin main:main
          git checkout main

      - name: Bump patch version
        id: bump-patch-version
        if: success()
        run: |
          cd extensions/ql-vscode
          # Bump to the next patch version. Major or minor version bumps will have to be done manually.
          # Record the next version number as an output of this step.
          NEXT_VERSION="$(npm version patch)"
          echo "next_version=$NEXT_VERSION" >> "$GITHUB_OUTPUT"

      - name: Add changelog for next release
        if: success()
        run: |
          cd extensions/ql-vscode
          perl -i -pe 's/^/## \[UNRELEASED\]\n\n/ if($.==3)' CHANGELOG.md

      - name: Create version bump PR
        uses: ./.github/actions/create-pr
        if: success()
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          commit-message: Bump version to ${{ steps.bump-patch-version.outputs.next_version }}
          title: Bump version to ${{ steps.bump-patch-version.outputs.next_version }}
          body: This PR was automatically generated by the GitHub Actions release workflow in this repository.
          head-branch: ${{ format('version/bump-to-{0}', steps.bump-patch-version.outputs.next_version) }}
          base-branch: main

  vscode-publish:
    name: Publish to VS Code Marketplace
    needs: build
    environment: publish-vscode-marketplace
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version-file: extensions/ql-vscode/.nvmrc

      - name: Download artifact
        uses: actions/download-artifact@v4
        with:
          name: vscode-codeql-extension

      - name: Azure User-assigned managed identity login
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          allow-no-subscriptions: true

      - name: Publish to Registry
        uses: azure/cli@v2
        with:
          azcliversion: latest
          inlineScript: |
            npx @vscode/vsce publish --azure-credential --packagePath *.vsix

  open-vsx-publish:
    name: Publish to Open VSX Registry
    needs: build
    environment: publish-open-vsx
    runs-on: ubuntu-latest
    env:
      OPEN_VSX_TOKEN: ${{ secrets.OPEN_VSX_TOKEN }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version-file: extensions/ql-vscode/.nvmrc

      - name: Download artifact
        uses: actions/download-artifact@v4
        with:
          name: vscode-codeql-extension

      - name: Publish to Registry
        run: |
          npx ovsx publish -p $OPEN_VSX_TOKEN *.vsix