AeonShopwareTools/.gitea/workflows/release.yml

name: release

# Plugin-agnostic: owner, repo, host, package name and version come from the `github` context
# and composer.json. shopware-cli runs from its official Docker image, intentionally unpinned (latest).
# RELEASE_TOKEN is the single token used for releases, assets and the Composer registry.
#
# Every step is idempotent (release/asset reuse, registry 409 = already published), so a failed run can
# simply be re-run and picks up where it stopped. There is deliberately no "tag exists -> skip" guard:
# it made a half-finished release (tag + release but no registry package) impossible to heal.

on:
  push:
    branches: [main]

permissions:
  contents: write
  packages: write

# Never run two releases at once; a second push waits instead of racing on the tag.
concurrency:
  group: release
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/shopware/shopware-cli:latest
    steps:
      - name: Ensure helper tools (jq, curl, unzip, zip, git)
        run: |
          command -v jq >/dev/null && command -v curl >/dev/null && command -v unzip >/dev/null && command -v zip >/dev/null && command -v git >/dev/null && exit 0
          (apt-get update -q && apt-get install -y -q --no-install-recommends jq curl unzip zip git) || apk add --no-cache jq curl unzip zip git

      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.RELEASE_TOKEN }}

      - name: Determine version, tag and file names
        id: meta
        run: |
          set -e
          VERSION=$(jq -r .version composer.json)
          PACKAGE_NAME=$(jq -r .name composer.json)
          REPO_NAME="${GITHUB_REPOSITORY#*/}"
          TAG="v${VERSION}"
          {
            echo "version=${VERSION}"
            echo "package_name=${PACKAGE_NAME}"
            echo "tag=${TAG}"
            echo "zip=${REPO_NAME}-${TAG}.zip"
          } >> "$GITHUB_OUTPUT"

      # Reuse the zip the PR workflow already built and tested for this exact tree.
      - name: Tree hash of this commit
        id: tree
        run: echo "hash=$(git rev-parse "${GITHUB_SHA}^{tree}")" >> "$GITHUB_OUTPUT"

      - name: Restore the tested zip from the PR run
        id: prebuilt
        uses: actions/cache/restore@v4
        with:
          path: .build/package.zip
          key: plugin-zip-${{ steps.tree.outputs.hash }}

      - name: Name the prebuilt zip
        if: steps.prebuilt.outputs.cache-hit == 'true'
        run: mv .build/package.zip ".build/${{ steps.meta.outputs.zip }}"

      # Packages only on a cache miss; always validates and asserts what ships (guards a bad cache entry).
      - uses: ./.gitea/actions/package
        with:
          filename: ${{ steps.meta.outputs.zip }}
          build: ${{ steps.prebuilt.outputs.cache-hit != 'true' }}

      - name: Extract changelog section
        run: |
          awk -v ver="${{ steps.meta.outputs.version }}" '
            BEGIN { found=0 }
            /^## \[/ {
              if (found) exit
              if ($0 ~ "\\[" ver "\\]") { found=1; next }
            }
            found { print }
          ' CHANGELOG.md > release-notes.md
          cat release-notes.md

      - name: Create Gitea release (creates the tag) and upload the zip
        env:
          TOKEN: ${{ secrets.RELEASE_TOKEN }}
        run: |
          set -e
          API="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
          TAG="${{ steps.meta.outputs.tag }}"
          ZIP="${{ steps.meta.outputs.zip }}"
          CODE=$(curl -s -o /tmp/release.json -w "%{http_code}" -H "Authorization: token ${TOKEN}" "${API}/releases/tags/${TAG}")
          if [ "$CODE" = "200" ]; then
            echo "Release ${TAG} already exists, reusing it."
          else
            BODY=$(jq -n --arg tag "$TAG" --arg sha "$GITHUB_SHA" --rawfile notes release-notes.md \
              '{tag_name:$tag, target_commitish:$sha, name:$tag, body:$notes}')
            curl -sf -H "Authorization: token ${TOKEN}" -H "Content-Type: application/json" -d "$BODY" "${API}/releases" > /tmp/release.json
          fi
          RELEASE_ID=$(jq -r .id /tmp/release.json)
          echo "release id: ${RELEASE_ID}"
          if jq -e --arg n "$ZIP" '.assets[]? | select(.name == $n)' /tmp/release.json > /dev/null; then
            echo "Asset ${ZIP} already uploaded."
          else
            curl -sf -H "Authorization: token ${TOKEN}" -F "attachment=@.build/${ZIP}" \
              "${API}/releases/${RELEASE_ID}/assets?name=${ZIP}" > /dev/null
          fi

      # Gitea's Composer registry needs composer.json at the zip root, but shopware-cli zips wrap
      # everything in one top-level folder (the registry answers 400 "composer.json file is missing").
      # Same prebuilt content, repacked root-level.
      - name: Repack the zip for the Composer registry
        run: |
          set -e
          rm -rf /tmp/repack && mkdir /tmp/repack
          unzip -q ".build/${{ steps.meta.outputs.zip }}" -d /tmp/repack
          if [ -f /tmp/repack/composer.json ]; then
            ROOT=/tmp/repack
          else
            ROOT=$(find /tmp/repack -mindepth 1 -maxdepth 1 -type d | head -1)
          fi
          test -f "$ROOT/composer.json" || { echo "::error::no composer.json found in the packaged zip"; exit 1; }
          OUT="$PWD/.build/composer-${{ steps.meta.outputs.zip }}"
          # explicit file list with the leading "./" stripped, so entries are stored as "composer.json", "src/..."
          (cd "$ROOT" && find . -mindepth 1 | sed 's|^\./||' | zip -q "$OUT" -@)
          unzip -l "$OUT" | grep -E ' composer\.json$' > /dev/null || { echo "::error::repacked zip has no root-level composer.json"; exit 1; }
          echo "repacked: $OUT"

      - name: Publish to the Composer registry
        run: |
          STATUS=$(curl -s -o /tmp/composer-publish.log -w "%{http_code}" \
            -u "${GITHUB_REPOSITORY_OWNER}:${{ secrets.RELEASE_TOKEN }}" \
            -T ".build/composer-${{ steps.meta.outputs.zip }}" \
            "${GITHUB_SERVER_URL}/api/packages/${GITHUB_REPOSITORY_OWNER}/composer")
          cat /tmp/composer-publish.log
          if [ "$STATUS" != "201" ] && [ "$STATUS" != "409" ]; then
            echo "Unexpected HTTP status $STATUS publishing to the Composer registry"
            exit 1
          fi

      - name: Link Composer package to this repository
        run: |
          ENCODED_NAME=$(printf '%s' "${{ steps.meta.outputs.package_name }}" | sed 's#/#%2F#g')
          STATUS=$(curl -s -o /dev/null -w "%{http_code}" -u "${GITHUB_REPOSITORY_OWNER}:${{ secrets.RELEASE_TOKEN }}" -X POST \
            "${GITHUB_SERVER_URL}/api/v1/packages/${GITHUB_REPOSITORY_OWNER}/composer/${ENCODED_NAME}/-/link/${GITHUB_REPOSITORY#*/}")
          echo "link status: $STATUS"
          if [ "$STATUS" != "201" ] && [ "$STATUS" != "400" ]; then
            echo "::warning::Unexpected status linking the Composer package to this repository (HTTP $STATUS) - not fatal, release already published"
          fi