release.yml

name: Release

# Push a tag like v2.0.1 and this builds, tests, creates the GitHub release, then submits
# the new version to every store it has credentials for (publish.yml). Each store then
# reviews the upload before it reaches users.
on:
  push:
    tags: ['v*']

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 25
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npx playwright install --with-deps chromium
      - name: Tag matches package.json
        run: test "v$(node -p 'require("./package.json").version')" = "$GITHUB_REF_NAME"
      - run: npm run build
      - run: npm test
      - run: node scripts/verify-load.mjs chrome
      - run: node scripts/verify-load.mjs edge
      - run: npm run test:e2e
      - name: Firefox smoke test
        run: npm run test:firefox
      - run: npm run package
      - name: Release notes from CHANGELOG
        run: |
          node -e '
            const v = process.env.GITHUB_REF_NAME.slice(1);
            const cl = require("fs").readFileSync("CHANGELOG.md", "utf8");
            const start = cl.indexOf(`## [${v}]`);
            if (start === -1) { console.error(`No CHANGELOG entry for ${v}`); process.exit(1); }
            const next = cl.indexOf("\n## [", start + 1);
            require("fs").writeFileSync("notes.md", cl.slice(cl.indexOf("\n", start) + 1, next === -1 ? undefined : next).trim() + "\n");
          '
      - name: GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release create "$GITHUB_REF_NAME" release/*.zip --title "SilentBlock ${GITHUB_REF_NAME#v}" --notes-file notes.md

  publish:
    needs: build
    uses: ./.github/workflows/publish.yml
    with:
      tag: ${{ github.ref_name }}
    permissions:
      contents: read
      id-token: write
    secrets: inherit