release.yml

name: Release

# Tag push `vX.Y.Z` → run the extension tests on three OSes → package the
# VSIX → attach a build-provenance attestation → publish a GitHub Release
# with generated notes → publish to the VS Code Marketplace when a VSCE_PAT
# secret exists.
#
# The X.Y.Z part of the tag has to equal `version` in package.json (checked
# in the test job) so a release never ships a VSIX whose manifest disagrees
# with its tag. A tag with a suffix — `v0.0.10-beta.1` — is a pre-release:
# the same checks run, the GitHub Release is marked pre-release, and the
# Marketplace step is skipped. The suffix never reaches the manifest,
# because the Marketplace rejects prerelease version strings.
# Put `[skip publish]` in the tagged commit's message to skip the
# Marketplace step while still creating the GitHub Release.

on:
  push:
    tags: ["v*"]

permissions:
  contents: read

jobs:
  test:
    name: Test (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
    strategy:
      fail-fast: true
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22
          cache: pnpm

      - name: Check tag matches package.json version
        shell: bash
        run: |
          set -euo pipefail
          tag="${GITHUB_REF_NAME#v}"
          base="${tag%%-*}"
          manifest="$(node -p "require('./package.json').version")"
          if [ "$base" != "$manifest" ]; then
            echo "::error::tag v$tag does not match package.json version $manifest"
            exit 1
          fi

      - run: pnpm install --frozen-lockfile

      - name: Refuse a version the Marketplace already has
        # The 0.0.10 GitHub release silently shared its number with a build
        # published to the Marketplace long before this pipeline existed, so
        # installing from the store served the old build. A burned version
        # number must fail here, before anything ships. Suffixed pre-release
        # tags reuse the base version by design and are exempt; a Marketplace
        # outage only warns, because it must not block a GitHub release.
        if: ${{ !contains(github.ref_name, '-') }}
        shell: bash
        run: |
          set -euo pipefail
          manifest="$(node -p "require('./package.json').version")"
          if listing="$(pnpm exec vsce show ShortArrow.line-number-deco --json 2>/dev/null)"; then
            if node -e 'const l=JSON.parse(process.argv[1]); process.exit(l.versions.some(v=>v.version===process.argv[2])?0:1)' "$listing" "$manifest"; then
              echo "::error::version $manifest already exists on the Marketplace; bump the version instead of reusing it"
              exit 1
            fi
          else
            echo "::warning::could not query the Marketplace; skipping the burned-version check"
          fi
          status="$(curl -s -o /dev/null -w '%{http_code}' "https://open-vsx.org/api/shortarrow/line-number-deco/$manifest" || echo 000)"
          if [ "$status" = "200" ]; then
            echo "::error::version $manifest already exists on Open VSX; bump the version instead of reusing it"
            exit 1
          elif [ "$status" != "404" ]; then
            echo "::warning::Open VSX returned $status; skipping its burned-version check"
          fi

      - name: Test (Linux, under Xvfb)
        if: runner.os == 'Linux'
        run: xvfb-run -a pnpm test

      - name: Test
        if: runner.os != 'Linux'
        run: pnpm test

  build:
    name: Package VSIX
    needs: test
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22
          cache: pnpm

      - run: pnpm install --frozen-lockfile

      - name: Package
        # All dependencies are devDependencies, so nothing from node_modules
        # belongs in the VSIX; --no-dependencies also keeps vsce away from
        # pnpm's non-hoisted node_modules layout.
        run: pnpm exec vsce package --no-dependencies

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: vsix
          path: "*.vsix"
          if-no-files-found: error

  smoke:
    name: Smoke test the VSIX
    # Runs on a fresh runner with only smoke/ checked out (sparse, cone
    # mode — root-level files come along, src/ and out/ do not), so the
    # only copy of the extension that can be found is the artifact. The
    # negative control proves the same assertions fail when the VSIX is
    # not installed; without it a green smoke run says nothing.
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: smoke
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: smoke

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22
          cache: pnpm
          cache-dependency-path: smoke/pnpm-lock.yaml

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: vsix
          path: artifacts

      - name: Derive the manifest version from the tag
        run: |
          set -euo pipefail
          tag="${GITHUB_REF_NAME#v}"
          echo "MANIFEST_VERSION=${tag%%-*}" >> "$GITHUB_ENV"

      - name: Structural check
        run: |
          set -euo pipefail
          vsix="$(ls "$GITHUB_WORKSPACE"/artifacts/*.vsix)"
          unzip -q "$vsix" -d "$RUNNER_TEMP/vsix-contents"
          node inspect-vsix.js "$RUNNER_TEMP/vsix-contents" "$MANIFEST_VERSION"

      - run: pnpm install --frozen-lockfile

      - name: Negative control (must fail without the VSIX)
        run: |
          set +e
          xvfb-run -a node run.js --expect-version "$MANIFEST_VERSION"
          rc=$?
          set -e
          if [ "$rc" -ne 1 ]; then
            echo "::error::expected the smoke test to fail with exit 1 when no VSIX is installed, got $rc"
            exit 1
          fi

      - name: Activation smoke
        run: |
          set -euo pipefail
          vsix="$(ls "$GITHUB_WORKSPACE"/artifacts/*.vsix)"
          xvfb-run -a node run.js --vsix "$vsix" --expect-version "$MANIFEST_VERSION"

  release:
    name: Create Release
    needs: smoke
    runs-on: ubuntu-latest
    permissions:
      contents: write
      # Required for actions/attest-build-provenance to mint a Sigstore
      # signing certificate via the GitHub OIDC provider.
      id-token: write
      attestations: write
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: vsix
          path: artifacts

      - name: Attest build provenance
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: artifacts/*.vsix

      - name: Create release
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          prerelease=()
          case "$TAG" in *-*) prerelease=(--prerelease) ;; esac
          gh release create "$TAG" \
            --repo "$GITHUB_REPOSITORY" \
            --title "$TAG" \
            --generate-notes \
            "${prerelease[@]}" \
            artifacts/*.vsix

  publish-marketplace:
    name: Publish to the registries
    needs: release
    # Pre-release tags (with a suffix) never go to the Marketplace, and
    # [skip publish] in the tagged commit's message opts a release out.
    if: ${{ !contains(github.event.head_commit.message, '[skip publish]') && !contains(github.ref_name, '-') }}
    runs-on: ubuntu-latest
    # Two credentials, tried in this order:
    #   1. Federated Entra identity (AZURE_CLIENT_ID / AZURE_TENANT_ID
    #      repository variables): secretless OIDC via the release
    #      environment. Requires the app registration to be a member of the
    #      publisher — which an MSA-owned publisher cannot express
    #      (TF14045), so this path stays dormant until the publisher moves
    #      under Entra.
    #   2. VSCE_PAT secret: the officially documented CI route.
    # With neither configured the job skips itself.
    environment: release
    permissions:
      contents: read
      id-token: write
    env:
      AZURE_CLIENT_ID: ${{ vars.AZURE_CLIENT_ID }}
      AZURE_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}
      VSCE_PAT: ${{ secrets.VSCE_PAT }}
      OVSX_PAT: ${{ secrets.OVSX_PAT }}
      USE_AZURE: ${{ vars.AZURE_CLIENT_ID != '' && vars.AZURE_TENANT_ID != '' && 'yes' || '' }}
    steps:
      - name: Skip when no credential is configured
        if: env.USE_AZURE == '' && env.VSCE_PAT == '' && env.OVSX_PAT == ''
        run: echo "None of the Entra variables, VSCE_PAT or OVSX_PAT are configured; skipping registry publish." >> "$GITHUB_STEP_SUMMARY"

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        if: env.USE_AZURE != '' || env.VSCE_PAT != '' || env.OVSX_PAT != ''
        with:
          persist-credentials: false

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
        if: env.USE_AZURE != '' || env.VSCE_PAT != '' || env.OVSX_PAT != ''

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        if: env.USE_AZURE != '' || env.VSCE_PAT != '' || env.OVSX_PAT != ''
        with:
          node-version: 22
          cache: pnpm

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        if: env.USE_AZURE != '' || env.VSCE_PAT != '' || env.OVSX_PAT != ''
        with:
          name: vsix
          path: artifacts

      - uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
        if: env.USE_AZURE != ''
        with:
          client-id: ${{ vars.AZURE_CLIENT_ID }}
          tenant-id: ${{ vars.AZURE_TENANT_ID }}
          allow-no-subscriptions: true

      - run: pnpm install --frozen-lockfile
        if: env.USE_AZURE != '' || env.VSCE_PAT != '' || env.OVSX_PAT != ''

      - name: Publish (Entra OIDC)
        if: env.USE_AZURE != ''
        run: pnpm exec vsce publish --azure-credential --packagePath artifacts/*.vsix

      - name: Publish (PAT)
        if: env.USE_AZURE == '' && env.VSCE_PAT != ''
        run: pnpm exec vsce publish --packagePath artifacts/*.vsix

      - name: Publish (Open VSX)
        if: env.OVSX_PAT != ''
        run: pnpm exec ovsx publish --packagePath artifacts/*.vsix -p "$OVSX_PAT"