release.yml

name: Create Release

on:
  push:
    # Trigger on pushes to the main or master branch.
    branches: [ main, master ]
  # Allow manual triggering.
  workflow_dispatch:

permissions:
  contents: write
  actions: read

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  PLUGIN_SLUG: enginescript-site-optimizer

jobs:
  check-and-release:
    if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Get latest version
        id: get_version
        run: |
          PLUGIN_FILE="${PLUGIN_SLUG}.php"
          VERSION=$(grep -oP "Version: \K[0-9]+\.[0-9]+\.[0-9]+" "$PLUGIN_FILE")
          [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Found version: $VERSION"

      - name: Check if release exists
        id: check_release
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ steps.get_version.outputs.version }}
        run: |
          # Transport/auth/rate-limit/server failures must never authorize publication.
          RELEASE_STATUS=$(curl --silent --show-error --proto '=https' \
            --connect-timeout 20 --max-time 60 \
            --header "Authorization: Bearer $GH_TOKEN" \
            --header 'Accept: application/vnd.github+json' \
            --output /dev/null --write-out '%{http_code}' \
            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/releases/tags/v$VERSION")
          case "$RELEASE_STATUS" in
            200) echo 'exists=true' >> "$GITHUB_OUTPUT" ;;
            404) echo 'exists=false' >> "$GITHUB_OUTPUT" ;;
            *) echo "::error::Release lookup failed (HTTP $RELEASE_STATUS)."; exit 1 ;;
          esac

      - name: Require successful quality checks for this commit
        if: steps.check_release.outputs.exists == 'false'
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ steps.get_version.outputs.version }}
        run: |
          # Fail closed while checks are queued/running. Rerun this release job
          # after the exact commit's compatibility workflow has passed.
          gh api --method GET \
            "repos/$GITHUB_REPOSITORY/actions/workflows/wp-compatibility-test.yml/runs" \
            -f head_sha="$GITHUB_SHA" -f branch="$GITHUB_REF_NAME" -f per_page=100 \
            > "$RUNNER_TEMP/quality-runs.json"
          RUN_ID=$(jq -er --arg sha "$GITHUB_SHA" --arg repo "$GITHUB_REPOSITORY" \
            --arg branch "$GITHUB_REF_NAME" '
            [.workflow_runs[] | select(.head_sha == $sha and .head_branch == $branch
              and .head_repository.full_name == $repo
              and (.event == "push" or .event == "workflow_dispatch"))]
            | sort_by(.id) | last
            | select(.status == "completed" and .conclusion == "success") | .id
            ' "$RUNNER_TEMP/quality-runs.json")
          gh api --paginate --slurp \
            "repos/$GITHUB_REPOSITORY/actions/runs/$RUN_ID/jobs?filter=latest&per_page=100" \
            > "$RUNNER_TEMP/quality-jobs.json"
          # A successful workflow with a skipped/missing gate is insufficient.
          jq -e '
            ["WP Plugin Check (PHP 8.3)", "PHPCS (PHP 8.3)", "WP VIP CS (PHP 8.3)",
             "PHPMD (PHP 8.3)", "Psalm Static Analysis (PHP 8.3)",
             "Security Scan (PHP 8.3)", "PHPStan for WP (PHP 8.3)",
             ( ["8.2", "8.3", "8.4", "8.5"][] as $php |
               ["6.8", "latest", "nightly"][] as $wp |
               "Test WordPress \($wp) with PHP \($php) (highest deps)" ),
             "Test WordPress latest with PHP 8.2 (lowest deps)"] as $expected
            | [.[].jobs[]] as $jobs
            | all($expected[]; . as $name |
                ([$jobs[] | select(.name == $name)] | length) == 1 and
                any($jobs[]; .name == $name and .status == "completed" and .conclusion == "success"))
            ' "$RUNNER_TEMP/quality-jobs.json"
          if git rev-parse --verify "refs/tags/v$VERSION" >/dev/null 2>&1; then
            [[ $(git rev-parse "refs/tags/v$VERSION^{commit}") == "$GITHUB_SHA" ]]
          fi
          echo "Quality evidence: $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$RUN_ID" \
            >> "$GITHUB_STEP_SUMMARY"

      - name: Update README version
        if: steps.check_release.outputs.exists == 'false'
        env:
          VERSION: ${{ steps.get_version.outputs.version }}
        run: |
          README_FILE="README.md"
          TMP_FILE=$(mktemp)

          # Update the version badge with the new version and logo
          sed -E "s#\[!\[Version\]\(https://img\.shields\.io/badge/Version-[0-9]+\.[0-9]+\.[0-9]+-orange\.svg\?logo=github\)\]\(https://github\.com/[^/]+/${PLUGIN_SLUG}/releases/(latest/download|download/v[0-9]+\.[0-9]+\.[0-9]+)/${PLUGIN_SLUG}-[0-9]+\.[0-9]+\.[0-9]+\.zip\)#[![Version](https://img.shields.io/badge/Version-${VERSION}-orange.svg?logo=github)](https://github.com/${{ github.repository }}/releases/latest/download/${PLUGIN_SLUG}-${VERSION}.zip)#g" "$README_FILE" > "$TMP_FILE"

          # Publication must use the reviewed commit, not a new untested bot commit.
          if ! cmp -s "$README_FILE" "$TMP_FILE"; then
            rm "$TMP_FILE"
            echo "::error::Update README.md version metadata in a reviewed commit before releasing."
            exit 1
          else
            echo "::notice::README.md already has the correct version"
          fi

          # Clean up temporary file
          rm "$TMP_FILE"

      - name: Create zip file
        if: steps.check_release.outputs.exists == 'false'
        run: |
          PLUGIN_FILE="${PLUGIN_SLUG}.php"
          rm -rf "$PLUGIN_SLUG"
          mkdir -p "$PLUGIN_SLUG"
          cp "$PLUGIN_FILE" "$PLUGIN_SLUG/"
          cp uninstall.php "$PLUGIN_SLUG/"
          cp -r includes "$PLUGIN_SLUG/"
          cp readme.txt "$PLUGIN_SLUG/"
          cp README.md "$PLUGIN_SLUG/"
          cp CHANGELOG.md "$PLUGIN_SLUG/"
          cp LICENSE "$PLUGIN_SLUG/"
          cp -r languages "$PLUGIN_SLUG/"
          zip -r "${PLUGIN_SLUG}-${{ steps.get_version.outputs.version }}.zip" "$PLUGIN_SLUG"
          python3 .github/scripts/check-plugin-package.py "$PLUGIN_SLUG" \
            --zip "${PLUGIN_SLUG}-${{ steps.get_version.outputs.version }}.zip"

      - name: Get changelog entry
        if: steps.check_release.outputs.exists == 'false'
        id: get_changelog
        run: |
          CHANGELOG_ENTRY=$(awk -v ver="${{ steps.get_version.outputs.version }}" 'BEGIN{flag=0; target="^## \\[?" ver "\\]?([[:space:]-]|$)"} $0 ~ target {flag=1; print; next} /^## \[?[0-9]+\.[0-9]+\.[0-9]+\]?([[:space:]-]|$)/ {flag=0} flag {print}' CHANGELOG.md | tail -n +2)
          echo "changelog<<EOF" >> "$GITHUB_OUTPUT"
          echo "$CHANGELOG_ENTRY" >> "$GITHUB_OUTPUT"
          echo "EOF" >> "$GITHUB_OUTPUT"

      - name: Create Release
        if: steps.check_release.outputs.exists == 'false'
        uses: softprops/action-gh-release@v3
        with:
          tag_name: v${{ steps.get_version.outputs.version }}
          target_commitish: ${{ github.sha }}
          fail_on_unmatched_files: true
          name: Release v${{ steps.get_version.outputs.version }}
          body: |
            ${{ steps.get_changelog.outputs.changelog }}

            ## Installation
            1. Download the zip file
            2. Upload to your WordPress site through the Plugins > Add New > Upload menu
            3. Activate the plugin

            [Full Documentation](https://github.com/${{ github.repository }})
          files: ${{ env.PLUGIN_SLUG }}-${{ steps.get_version.outputs.version }}.zip
          draft: false
          prerelease: false
          generate_release_notes: false