plugin-release.yml

name: Plugin Release

on:
  workflow_dispatch:
    inputs:
      release_tag:
        description: "GitHub release tag to create or update"
        required: true
      release_name:
        description: "Optional release title"
        required: false
      source:
        description: "Catalog source label"
        required: true
        default: "official"

permissions:
  contents: write

jobs:
  package-plugin:
    name: Package plugin (${{ matrix.platform.name }})
    strategy:
      fail-fast: false
      matrix:
        platform:
          - name: windows-x64
            os: windows-latest
            target: x86_64-pc-windows-msvc
            asset_suffix: ""
            artifact_suffix: windows-x64
          - name: macos-arm64
            os: macos-26
            target: aarch64-apple-darwin
            asset_suffix: macos-arm64
            artifact_suffix: macos-arm64
    runs-on: ${{ matrix.platform.os }}

    env:
      HF_PLUGIN_SIGNING_PRIVATE_KEY: ${{ secrets.HF_PLUGIN_SIGNING_PRIVATE_KEY }}
      HF_PLUGIN_SIGNING_KEY_ID: ${{ secrets.HF_PLUGIN_SIGNING_KEY_ID }}
      HF_ADMIN_TOKEN: ${{ secrets.HF_ADMIN_TOKEN }}

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
        with:
          toolchain: 1.97.0
          targets: ${{ matrix.platform.target }}

      - name: Validate release inputs
        shell: pwsh
        run: |
          $tag = "${{ inputs.release_tag }}".Trim()
          $title = "${{ inputs.release_name }}".Trim()

          if ([string]::IsNullOrWhiteSpace($tag)) {
            throw "release_tag is required."
          }
          if ($tag -match "System\.Collections\.Hashtable" -or $title -match "System\.Collections\.Hashtable") {
            throw 'Workflow inputs were expanded incorrectly. In PowerShell, use $($release.tag) instead of "$release.tag" when dispatching this workflow.'
          }
          if ($tag -notmatch '^v\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$') {
            throw "release_tag '$tag' must look like v1.2.3 or v1.2.3-rc.1."
          }
          if ([string]::IsNullOrWhiteSpace($title)) {
            $title = "Plugin $tag"
          }

          "RELEASE_TAG=$tag" | Out-File -FilePath $env:GITHUB_ENV -Append
          "RELEASE_TITLE=$title" | Out-File -FilePath $env:GITHUB_ENV -Append

      - name: Package .hfpkg
        shell: pwsh
        run: |
          $target = "${{ matrix.platform.target }}"
          $suffix = "${{ matrix.platform.asset_suffix }}"
          npx --yes @haloforge/plugin-pack@0.2.17 pack . --release --target $target --out dist/plugin-release
          $pkg = Get-ChildItem dist/plugin-release -Filter *.hfpkg | Select-Object -First 1
          if (-not $pkg) { throw "No .hfpkg artifact was created." }
          if ([string]::IsNullOrWhiteSpace($suffix)) {
            $packageName = $pkg.Name
            $packagePath = $pkg.FullName
          } else {
            $packageName = "$([System.IO.Path]::GetFileNameWithoutExtension($pkg.Name))-$suffix.hfpkg"
            $packagePath = Join-Path $pkg.DirectoryName $packageName
            Move-Item -Path $pkg.FullName -Destination $packagePath -Force
          }
          Get-ChildItem dist/plugin-release -Filter *.hfpkg.sha256 | Remove-Item -Force
          $digest = (Get-FileHash -Algorithm SHA256 -Path $packagePath).Hash.ToLowerInvariant()
          $shaPath = "$packagePath.sha256"
          "$digest  $packageName" | Set-Content -Path $shaPath
          "PKG_PATH=$packagePath" | Out-File -FilePath $env:GITHUB_ENV -Append
          "PKG_NAME=$packageName" | Out-File -FilePath $env:GITHUB_ENV -Append
          "SHA_PATH=$shaPath" | Out-File -FilePath $env:GITHUB_ENV -Append
          "PLUGIN_PLATFORM_SUFFIX=$suffix" | Out-File -FilePath $env:GITHUB_ENV -Append

      - name: Create or update GitHub release
        shell: pwsh
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          function Invoke-ReleaseUpload {
            param(
              [Parameter(Mandatory = $true)][string]$Tag,
              [Parameter(Mandatory = $true)][string]$Path
            )

            if (-not (Test-Path $Path)) {
              throw "Release asset not found: $Path"
            }

            $assetName = Split-Path -Leaf $Path
            for ($attempt = 1; $attempt -le 3; $attempt++) {
              & gh release upload $Tag $Path --clobber
              if ($LASTEXITCODE -eq 0) {
                return
              }
              if ($attempt -eq 3) {
                throw "Failed to upload $assetName to release $Tag after $attempt attempts."
              }
              Start-Sleep -Seconds (2 * $attempt)
              & gh release view $Tag --json tagName,url *> $null
            }
          }

          & gh release view $env:RELEASE_TAG --json tagName,url *> $null
          if ($LASTEXITCODE -ne 0) {
            & gh release create $env:RELEASE_TAG --title $env:RELEASE_TITLE --notes "Automated HaloForge plugin release"
            if ($LASTEXITCODE -ne 0) {
              & gh release view $env:RELEASE_TAG --json tagName,url *> $null
              if ($LASTEXITCODE -ne 0) {
                throw "Failed to create release $env:RELEASE_TAG."
              }
            }
            Start-Sleep -Seconds 2
          } else {
            & gh release edit $env:RELEASE_TAG --title $env:RELEASE_TITLE --notes "Automated HaloForge plugin release"
            if ($LASTEXITCODE -ne 0) {
              throw "Failed to update release $env:RELEASE_TAG."
            }
          }

          Invoke-ReleaseUpload -Tag $env:RELEASE_TAG -Path $env:PKG_PATH
          Invoke-ReleaseUpload -Tag $env:RELEASE_TAG -Path $env:SHA_PATH

      - name: Generate catalog draft metadata
        shell: pwsh
        run: |
          $artifactUrl = "https://github.com/${{ github.repository }}/releases/download/$env:RELEASE_TAG/$env:PKG_NAME"
          if ([string]::IsNullOrWhiteSpace($env:PLUGIN_PLATFORM_SUFFIX)) {
            $draftPath = "dist/plugin-release/catalog-draft.json"
          } else {
            $draftPath = "dist/plugin-release/catalog-draft-$env:PLUGIN_PLATFORM_SUFFIX.json"
          }
          $args = @(
            "--yes", "@haloforge/plugin-pack@0.2.17",
            "metadata", "$env:PKG_PATH",
            "--artifact-url", $artifactUrl,
            "--source", "${{ inputs.source }}",
            "--homepage-url", "https://haloforge.link/catalog/plugins/git",
            "--repository-url", "https://github.com/${{ github.repository }}",
            "--pretty",
            "--output", $draftPath
          )
          if ($env:HF_PLUGIN_SIGNING_KEY_ID) {
            $args += @("--signing-key-id", $env:HF_PLUGIN_SIGNING_KEY_ID)
          }
          if ($env:HF_PLUGIN_SIGNING_PRIVATE_KEY) {
            $args += @("--signing-key-env", "HF_PLUGIN_SIGNING_PRIVATE_KEY")
          }
          npx @args
          if ($LASTEXITCODE -ne 0) {
            throw "Failed to generate catalog draft metadata."
          }

          $draft = Get-Content $draftPath -Raw | ConvertFrom-Json
          if ($draft.version.artifact_url -ne $artifactUrl) {
            throw "Generated catalog draft artifact_url does not match the release tag."
          }
          "CATALOG_DRAFT_PATH=$draftPath" | Out-File -FilePath $env:GITHUB_ENV -Append

      - name: Upload metadata to release
        shell: pwsh
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          $paths = @($env:CATALOG_DRAFT_PATH)
          if ($env:LEGACY_CATALOG_DRAFT_PATH) {
            $paths += $env:LEGACY_CATALOG_DRAFT_PATH
          }

          foreach ($path in $paths) {
            if (-not (Test-Path $path)) {
              throw "Release asset not found: $path"
            }

            for ($attempt = 1; $attempt -le 3; $attempt++) {
              & gh release upload $env:RELEASE_TAG $path --clobber
              if ($LASTEXITCODE -eq 0) {
                break
              }
              if ($attempt -eq 3) {
                throw "Failed to upload $path to release $env:RELEASE_TAG after $attempt attempts."
              }
              Start-Sleep -Seconds (2 * $attempt)
              & gh release view $env:RELEASE_TAG --json tagName,url *> $null
            }
          }

      - name: Submit catalog draft
        if: env.HF_ADMIN_TOKEN != ''
        shell: pwsh
        run: npx --yes @haloforge/plugin-pack@0.2.17 submit $env:CATALOG_DRAFT_PATH --api-base-url https://admin.haloforge.dev --token-env HF_ADMIN_TOKEN

      - name: Upload workflow artifacts
        uses: actions/upload-artifact@v4
        with:
          name: plugin-release-${{ matrix.platform.artifact_suffix }}-${{ github.run_id }}
          path: |
            dist/plugin-release/*.hfpkg
            dist/plugin-release/*.hfpkg.sha256
            dist/plugin-release/catalog-draft*.json