KoalaSync/.github/workflows/release.yml

name: Release KoalaSync

on:
  push:
    tags:
      - 'v*'

# A release run must never be interrupted (it commits back to main and publishes
# artifacts). Only dedupe accidental re-pushes of the same tag.
concurrency:
  group: release-${{ github.ref_name }}
  cancel-in-progress: false

jobs:
  release-server:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=raw,value=latest
            type=ref,event=tag

      - name: Build and push Docker image
        id: build
        uses: docker/build-push-action@v7
        with:
          context: .
          file: server/Dockerfile
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          # Reuse layers across releases to speed up the multi-arch build.
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Generate artifact attestation
        uses: actions/attest@v4
        with:
          subject-name: ghcr.io/${{ github.repository }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true

  release-extension:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
      attestations: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '24'
          cache: 'npm'

      - name: Extract version from tag
        id: version
        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> $GITHUB_OUTPUT

      - name: Inject version into source files
        run: |
          VERSION=${{ steps.version.outputs.VERSION }}
          DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
          echo "Injecting version $VERSION from tag $GITHUB_REF_NAME..."

          # 1. extension/manifest.base.json
          jq --arg v "$VERSION" '.version = $v' extension/manifest.base.json > tmp.json && mv tmp.json extension/manifest.base.json
          echo "  ✓ manifest.base.json -> $VERSION"

          # 2. shared/constants.js — APP_VERSION
          sed -i "s/export const APP_VERSION = [\"'].*[\"']/export const APP_VERSION = \"$VERSION\"/" shared/constants.js
          echo "  ✓ shared/constants.js -> $VERSION"

          # 3. package.json
          jq --arg v "$VERSION" '.version = $v' package.json > tmp.json && mv tmp.json package.json
          echo "  ✓ package.json -> $VERSION"

          # 4. website/version.json
          jq -n --arg v "$VERSION" --arg d "$DATE" '{version: $v, date: $d}' > website/version.json
          echo "  ✓ website/version.json -> version $VERSION, date $DATE"

          # 5. website/template.html — SoftwareApplication schema
          sed -i "s/\"softwareVersion\": \".*\"/\"softwareVersion\": \"$VERSION\"/" website/template.html
          echo "  ✓ website/template.html -> softwareVersion $VERSION"

          # 6. website/llms.txt — machine-readable release metadata
          sed -i "s/Current website release: .*/Current website release: $VERSION/" website/llms.txt
          echo "  ✓ website/llms.txt -> $VERSION"

          # 7. README.md — version badge & banner
          sed -i "s|Release-v[0-9]\+\.[0-9]\+\.[0-9]\+-blue|Release-v$VERSION-blue|g" README.md
          sed -i "s/New v[0-9]\+\.[0-9]\+\.[0-9]\+ Release/New v$VERSION Release/g" README.md
          echo "  ✓ README.md -> v$VERSION"

          echo "Version injection complete."

      - name: Commit and push version updates back to main
        run: |
          git config --local user.email "action@github.com"
          git config --local user.name "GitHub Action"
          git add extension/manifest.base.json shared/constants.js package.json website/version.json website/template.html website/llms.txt README.md
          git commit -m "chore(release): update versions to $GITHUB_REF_NAME [skip ci]" || echo "No changes to commit"
          git push origin HEAD:main
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Build Extensions
        run: |
          npm ci
          npm run build:extension

      - name: Generate artifact attestation for extensions
        uses: actions/attest@v4
        with:
          subject-path: dist/koalasync-*.zip

      - name: Build Website
        run: node website/build.cjs

      - name: Upload Website Artifacts
        uses: actions/upload-artifact@v7
        with:
          name: website-www
          path: website/www/
          if-no-files-found: error

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          files: |
            dist/koalasync-chrome.zip
            dist/koalasync-firefox.zip
          name: Release ${{ github.ref_name }}
          generate_release_notes: true
          draft: false
          prerelease: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}