chore: remove WebP test image after successful verification (#260) #139
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish Extension | |
| on: | |
| push: | |
| tags: | |
| - 'git-id-switcher-v*' | |
| permissions: {} | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| environment: production | |
| # Prevent forks from publishing | |
| if: github.repository == 'nullvariant/nullvariant-vscode-extensions' | |
| permissions: | |
| contents: write | |
| id-token: write | |
| attestations: write | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 | |
| with: | |
| node-version: '20' | |
| cache: 'npm' | |
| cache-dependency-path: package-lock.json | |
| # Install at root level for npm workspaces | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Compile | |
| run: npm run compile | |
| working-directory: extensions/git-id-switcher | |
| - name: Package extension | |
| run: npm run package | |
| working-directory: extensions/git-id-switcher | |
| - name: Get version from tag | |
| id: version | |
| run: echo "version=${GITHUB_REF#refs/tags/git-id-switcher-v}" >> $GITHUB_OUTPUT | |
| # SLSA Provenance: Generate attestation via GitHub Attestation API | |
| # This creates verifiable build provenance for supply chain security | |
| - name: Generate SLSA Provenance attestation | |
| id: provenance | |
| uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0 | |
| with: | |
| subject-path: extensions/git-id-switcher/*.vsix | |
| # Copy the provenance bundle to release assets for OpenSSF Scorecard detection | |
| # The bundle is also stored in GitHub Attestation API for `gh attestation verify` | |
| - name: Prepare provenance for release | |
| run: | | |
| BUNDLE_PATH="${{ steps.provenance.outputs.bundle-path }}" | |
| DEST_PATH="extensions/git-id-switcher/git-id-switcher-${{ steps.version.outputs.version }}.vsix.intoto.jsonl" | |
| if [ -z "$BUNDLE_PATH" ]; then | |
| echo "::error::Provenance bundle path is empty" | |
| exit 1 | |
| fi | |
| if [ ! -f "$BUNDLE_PATH" ]; then | |
| echo "::error::Provenance bundle file not found: $BUNDLE_PATH" | |
| exit 1 | |
| fi | |
| cp "$BUNDLE_PATH" "$DEST_PATH" | |
| echo "Provenance bundle copied to: $DEST_PATH" | |
| ls -la "$DEST_PATH" | |
| - name: Upload VSIX artifact | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 | |
| with: | |
| name: git-id-switcher-${{ steps.version.outputs.version }}.vsix | |
| path: extensions/git-id-switcher/*.vsix | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0 | |
| with: | |
| files: | | |
| extensions/git-id-switcher/*.vsix | |
| extensions/git-id-switcher/*.intoto.jsonl | |
| generate_release_notes: true | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Publish to VS Code Marketplace | |
| if: ${{ vars.PUBLISH_TO_MARKETPLACE == 'true' }} | |
| run: npx vsce publish --packagePath git-id-switcher-${{ steps.version.outputs.version }}.vsix -p ${{ secrets.VSCE_PAT }} | |
| working-directory: extensions/git-id-switcher | |
| - name: Publish to Open VSX | |
| if: ${{ vars.PUBLISH_TO_OPENVSX == 'true' }} | |
| run: npx ovsx publish git-id-switcher-${{ steps.version.outputs.version }}.vsix -p ${{ secrets.OVSX_PAT }} | |
| working-directory: extensions/git-id-switcher | |
| - name: Deploy documentation to R2 | |
| run: | | |
| R2_BASE="nullvariant-assets/nullvariant-vscode-extensions" | |
| EXT_PATH="extensions/git-id-switcher" | |
| # Upload all language READMEs from docs/i18n/ (including en/) | |
| for lang_dir in ${EXT_PATH}/docs/i18n/*/; do | |
| lang=$(basename "$lang_dir") | |
| echo "Deploying ${lang}/README.md..." | |
| npx wrangler@4.54.0 r2 object put "${R2_BASE}/${EXT_PATH}/docs/i18n/${lang}/README.md" \ | |
| --file "${lang_dir}README.md" \ | |
| --content-type "text/markdown; charset=utf-8" \ | |
| --remote | |
| done | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} |