release.yml

name: Release

on:
  push:
    branches: [main]
    paths:
      - manifest.json
      - package.json

concurrency:
  group: release
  cancel-in-progress: false

permissions: {}

jobs:
  check:
    name: Check for version bump
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      release: ${{ steps.check.outputs.release }}
      version: ${{ steps.version.outputs.version }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false

      - name: Read and validate version
        id: version
        run: |
          VERSION=$(jq -r .version manifest.json)
          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "::error::Invalid version in manifest.json: $VERSION"
            exit 1
          fi
          PKG=$(jq -r .version package.json)
          if [[ "$VERSION" != "$PKG" ]]; then
            echo "::error::Version mismatch: manifest.json=$VERSION package.json=$PKG (keep them in sync)"
            exit 1
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Has this version been released?
        id: check
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          if gh release view "v$VERSION" >/dev/null 2>&1; then
            echo "release=false" >> "$GITHUB_OUTPUT"
            echo "v$VERSION already released — nothing to do."
          else
            echo "release=true" >> "$GITHUB_OUTPUT"
            echo "v$VERSION is new — will build and publish."
          fi

  build:
    name: Build extensions
    needs: check
    if: ${{ needs.check.outputs.release == 'true' }}
    runs-on: ubuntu-latest
    environment: build
    permissions:
      contents: write
    outputs:
      version: ${{ needs.check.outputs.version }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false

      - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 22

      - run: pnpm install --frozen-lockfile

      - name: Build Chrome extension
        run: pnpm build-chrome
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}

      - name: Zip Chrome extension
        env:
          VERSION: ${{ needs.check.outputs.version }}
        run: cd dist && zip -r "../batchcamp-chrome-${VERSION}.zip" .

      - name: Clean Chrome build
        run: rm -rf dist

      - name: Build Firefox extension
        run: pnpm build-firefox
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}

      - name: Lint Firefox build
        uses: kewisch/action-web-ext@84a13bb9e1b6108c43788ba091c41ca1dba6ad45 # v2.0
        with:
          cmd: lint
          source: dist
          channel: listed

      - name: Zip Firefox extension
        env:
          VERSION: ${{ needs.check.outputs.version }}
        run: cd dist && zip -r "../batchcamp-firefox-${VERSION}.zip" .

      - name: Clean Firefox build
        run: rm -rf dist

      - name: Zip source for Firefox review
        run: git archive --format=zip --output=batchcamp-source.zip HEAD

      - name: Create release and attach builds
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ needs.check.outputs.version }}
        run: |
          gh release create "v$VERSION" \
            --title "v$VERSION" \
            --notes "" \
            "batchcamp-chrome-${VERSION}.zip" \
            "batchcamp-firefox-${VERSION}.zip"

      - name: Upload builds for publishing
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: extension-builds
          path: |
            batchcamp-chrome-${{ needs.check.outputs.version }}.zip
            batchcamp-firefox-${{ needs.check.outputs.version }}.zip
            batchcamp-source.zip
          retention-days: 7
          if-no-files-found: error

  chrome:
    name: Publish to Chrome Web Store
    needs: build
    runs-on: ubuntu-latest
    environment: Chrome
    permissions: {}
    steps:
      - name: Download builds
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: extension-builds

      - name: Upload to Chrome Web Store
        uses: mnao305/chrome-extension-upload@fdfe79400af990f5145a319e834aee64907ccff4 # v6.0.0
        with:
          file-path: batchcamp-chrome-${{ needs.build.outputs.version }}.zip
          extension-id: ${{ secrets.CHROME_EXTENSION_ID }}
          client-id: ${{ secrets.CHROME_CLIENT_ID }}
          client-secret: ${{ secrets.CHROME_CLIENT_SECRET }}
          refresh-token: ${{ secrets.CHROME_REFRESH_TOKEN }}
          publish: true

  firefox:
    name: Publish to Firefox AMO
    needs: build
    runs-on: ubuntu-latest
    environment: Firefox
    permissions: {}
    steps:
      - name: Download builds
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: extension-builds

      - name: Upload to Firefox AMO
        uses: kewisch/action-web-ext@84a13bb9e1b6108c43788ba091c41ca1dba6ad45 # v2.0
        with:
          cmd: sign
          source: batchcamp-firefox-${{ needs.build.outputs.version }}.zip
          channel: listed
          apiKey: ${{ secrets.AMO_API_KEY }}
          apiSecret: ${{ secrets.AMO_API_SECRET }}
          sourceCode: batchcamp-source.zip
          approvalTimeout: 0