release.yml

on:
  push:
    tags:
      - "v*.*.*"
  workflow_dispatch:
env:
  PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: true
jobs:
  convert-release-as-draft:
    name: Convert release to draft
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
      - run: chmod +x .hacking/scripts/convert_release_to_draft.sh
      - run: .hacking/scripts/convert_release_to_draft.sh
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  check-versions-match:
    name: Check versions match
    runs-on: ubuntu-latest
    needs:
      - convert-release-as-draft
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
      - name: Install jq
        run: sudo apt-get install jq
      - name: Allow running check_versions_match.sh
        run: chmod +x ./.hacking/scripts/check_versions_match.sh
      - name: Check release version matches code
        run: |
          RELEASE_VERSION=${{ github.event.release.tag_name }}
          STRIPPED_VERSION=${RELEASE_VERSION#v}
          ./.hacking/scripts/check_versions_match.sh $STRIPPED_VERSION
  release-vsix:
    name: Release VSIX
    runs-on: ubuntu-latest
    needs:
      - check-versions-match
    permissions:
      id-token: write
      contents: write
      attestations: write
      packages: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
      - name: Setup Bazel
        uses: bazel-contrib/setup-bazel@c5acdfb288317d0b5c0bbd7a396a3dc868bb0f86 # ratchet:bazel-contrib/setup-bazel@0.19.0
        with:
          bazelisk-cache: true
          disk-cache: ${{ github.workflow }}
          repository-cache: true
      - name: Build VS Code extension
        run: bazel build //editors/code:vscode_extension
      - name: Copy VSIX to expected location
        run: cp bazel-bin/editors/code/*.vsix editors/code/
      - name: Generate artifact attestation
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # ratchet:actions/attest-build-provenance@v4.1.0
        with:
          subject-path: "editors/code/*.vsix"
      - name: Publish GitHub release
        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # ratchet:ncipollo/release-action@v1
        with:
          allowUpdates: true
          draft: true
          omitBody: true
          omitBodyDuringUpdate: true
          omitNameDuringUpdate: true
          omitDraftDuringUpdate: true
          artifacts: |
            editors/code/*.vsix
  release:
    name: Release ${{ matrix.platform.target }}
    runs-on: ${{ matrix.platform.os }}
    needs:
      - check-versions-match
    permissions:
      id-token: write
      contents: write
      attestations: write
      packages: write
    strategy:
      fail-fast: false
      matrix:
        platform:
          - name: sqruff-linux-x86_64-musl.tar.gz
            os: ubuntu-latest
            target: x86_64-unknown-linux-musl
            bin: sqruff
          - name: sqruff-linux-aarch64-musl.tar.gz
            os: ubuntu-latest
            target: aarch64-unknown-linux-musl
            bin: sqruff
          - name: sqruff-windows-x86_64.zip
            os: windows-latest
            target: x86_64-pc-windows-msvc
            bin: sqruff.exe
          - name: sqruff-darwin-x86_64.tar.gz
            os: macos-15-intel
            target: x86_64-apple-darwin
            bin: sqruff
          - name: sqruff-darwin-aarch64.tar.gz
            os: macOS-latest
            target: aarch64-apple-darwin
            bin: sqruff
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
      - uses: ./.github/actions/build-binaries
        with:
          package: true
          publish: true
      - name: Publish GitHub release
        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # ratchet:ncipollo/release-action@v1
        with:
          allowUpdates: true
          draft: true
          omitBody: true
          omitBodyDuringUpdate: true
          omitNameDuringUpdate: true
          omitDraftDuringUpdate: true
          artifacts: |
            sqruff-*
  build-and-push-docker:
    name: Build and Push Docker Image
    runs-on: ubuntu-latest
    needs:
      - check-versions-match
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
      - name: Set up QEMU
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # ratchet:docker/setup-qemu-action@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # ratchet:docker/setup-buildx-action@v4
      - name: Login to GitHub Container Registry
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # ratchet:docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and Push Docker Image
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # ratchet:docker/build-push-action@v7
        with:
          context: .
          push: true
          tags: |
            ghcr.io/${{ github.repository_owner }}/sqruff:${{ github.ref_name }}
            ghcr.io/${{ github.repository_owner }}/sqruff:latest
          platforms: linux/amd64,linux/arm64
  convert_release_to_not_draft:
    name: Convert release to not draft
    runs-on: ubuntu-latest
    permissions: write-all
    needs:
      - release
      - release-vsix
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
      - run: chmod +x ./.hacking/scripts/convert_release_to_not_draft.sh
      - run: ./.hacking/scripts/convert_release_to_not_draft.sh
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  publish-to-cargo:
    name: Publish to Cargo
    runs-on: ubuntu-latest
    needs: [convert_release_to_not_draft]
    environment: release
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
      - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # ratchet:actions-rs/toolchain@v1
        with:
          toolchain: stable
          profile: minimal
      - name: Authenticate with crates.io
        uses: rust-lang/crates-io-auth-action@bbd81622f20ce9e2dd9622e3218b975523e45bbe # ratchet:rust-lang/crates-io-auth-action@v1
        id: auth
      - name: Publish sqruff-lib-core to Cargo
        run: cargo publish -p sqruff-lib-core
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
      - name: Publish sqruff-lib-dialects to Cargo
        run: cargo publish -p sqruff-lib-dialects
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
      - name: Publish sqruff-lib to Cargo
        run: cargo publish -p sqruff-lib
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
      - name: Publish sqruff-lsp to Cargo
        run: cargo publish -p sqruff-lsp
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
      - name: Publish sqruff-cli-lib to Cargo
        run: cargo publish -p sqruff-cli-lib
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
      - name: Publish sqruff to Cargo
        run: cargo publish -p sqruff
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
      - name: Publish sqruff-sqlinference to Cargo
        run: cargo publish -p sqruff-sqlinference
        env:
          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
  publish-to-marketplace:
    name: Publish VSIX to VSCode Marketplace
    runs-on: ubuntu-latest
    needs:
      - release-vsix
      - convert_release_to_not_draft
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # ratchet:actions/setup-node@v6.3.0
        with:
          node-version-file: ".nvmrc"
      - run: npm install -g vsce
      - run: chmod +x .hacking/scripts/download_extension.sh
      - run: ./.hacking/scripts/download_extension.sh
      - run: vsce publish --packagePath extension.vsix
        env:
          VSCE_PAT: ${{ secrets.VSCE_PAT }} # Set up the VSCE Personal Access Token in GitHub secrets
  publish-to-openvsx:
    name: Publish VSIX to Open VSX
    runs-on: ubuntu-latest
    needs:
      - release-vsix
      - convert_release_to_not_draft
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # ratchet:actions/setup-node@v6.3.0
        with:
          node-version-file: ".nvmrc"
      - run: npm install -g ovsx
      - run: chmod +x .hacking/scripts/download_extension.sh
      - run: ./.hacking/scripts/download_extension.sh
      - run: ovsx publish -p ${{ secrets.OPEN_VSX_TOKEN }} extension.vsix