release.yml

name: Release

on:
  workflow_dispatch: # allows to be run manually
    inputs:
      version_component_to_bump:
        description: 'Version component to bump'
        required: true
        type: choice
        options:
          - '[select]'
          - patch
          - minor
          - major
        default: '[select]'

# Allow one concurrent release
concurrency:
  group: "releases"

permissions:
  contents: write

jobs:
  validate_input:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Stop on non-default branch
        if: github.ref != format('refs/heads/{0}', github.event.repository.default_branch)
        run: |
          echo "It's only possible to create a release from the default branch (${{ github.event.repository.default_branch }})." 1>&2
          exit 1
      - name: Stop on missing version component to bump
        if: inputs.version_component_to_bump == '[select]'
        run: |
          echo "Please select a version component to bump." 1>&2
          exit 1
  bump_version_and_tag:
    needs: validate_input
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Clone repository
        uses: actions/checkout@v5
      - name: Set release commit author
        run: |
          git config --local user.email '${{ github.actor }}@users.noreply.github.com'
          git config --local user.name '${{ github.actor }}'
      - name: Bump version
        run: make bump_version_in_container bump='${{ inputs.version_component_to_bump }}' # also creates the commit and tag
      - name: Push release commit
        uses: ad-m/github-push-action@v1.0.0
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          branch: ${{ github.ref }}
          tags: true
      - name: Output - release tag
        id: output_release_tag
        run: echo "release_tag=$(git describe --tags --exact-match --abbrev=0)" >> $GITHUB_OUTPUT
    outputs:
      release_tag: ${{ steps.output_release_tag.outputs.release_tag }}
  build:
    needs: bump_version_and_tag
    uses: ./.github/workflows/build.yml
    with:
      checkout_ref: ${{ format('refs/tags/{0}', needs.bump_version_and_tag.outputs.release_tag) }}
  create_github_release:
    needs:
      - bump_version_and_tag
      - build
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Download built add-on for release
        uses: actions/download-artifact@v6
        with:
          name: ${{ needs.build.outputs.production_artifact_name }}
          path: dist
      - name: Prepare release packages
        run: |
          shopt -s globstar
          cp ./dist/**/pontoon_add-on-*.zip ./dist/**/privacy-policy-*.html .
          ls -l .
      - name: Create GitHub release
        id: create_release
        uses: softprops/action-gh-release@v2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          tag_name: ${{ needs.bump_version_and_tag.outputs.release_tag }}
          files: |
            pontoon_add-on-*.zip
            privacy-policy-*.html
          fail_on_unmatched_files: true
          draft: false
          prerelease: false
  publish_to_amo:
    needs:
      - bump_version_and_tag
      - build
      - create_github_release
    runs-on: ubuntu-latest
    environment: addons.mozilla.org
    timeout-minutes: 10
    steps:
      - name: Download built add-on to publish
        uses: actions/download-artifact@v6
        with:
          name: ${{ needs.build.outputs.production_artifact_name }}
          path: dist
      - name: Download source code archive
        run: wget 'https://github.com/mozilla-l10n/pontoon-addon/archive/refs/tags/${{ needs.bump_version_and_tag.outputs.release_tag }}.zip'
      - name: Publish to addons.mozilla.org
        env:
          WEB_EXT_API_KEY: ${{ secrets.WEB_EXT_API_KEY }}
          WEB_EXT_API_SECRET: ${{ secrets.WEB_EXT_API_SECRET }}
        run: |
          npx web-ext@8 sign \
            --channel=listed \
            --approval-timeout=0 `# Pontoon Add-on is approved manually, don't wait for it` \
            --source-dir=./dist/mozilla/src \
            --upload-source-code=./${{ needs.bump_version_and_tag.outputs.release_tag }}.zip \
            --amo-metadata=./dist/mozilla/amo-metadata.json
  publish_to_chrome_web_store:
    needs:
      - bump_version_and_tag
      - build
      - create_github_release
    runs-on: ubuntu-latest
    environment: Chrome Web Store
    timeout-minutes: 10
    steps:
      - name: Download built add-on to publish
        uses: actions/download-artifact@v6
        with:
          name: ${{ needs.build.outputs.production_artifact_name }}
          path: dist
      - name: Publish to Chrome Web Store
        env:
          EXTENSION_ID: ${{ secrets.EXTENSION_ID }}
          CLIENT_ID: ${{ secrets.CLIENT_ID }}
          CLIENT_SECRET: ${{ secrets.CLIENT_SECRET }}
          REFRESH_TOKEN: ${{ secrets.REFRESH_TOKEN }}
        run: |
          npx chrome-webstore-upload-cli@3 \
            --source=./dist/chromium/src