release.yml

name: Release

# Releases are cut automatically when `main` advances. The job reads the version
# from manifest.json and, if that version has not been released yet, creates and
# pushes the matching tag (bare version, no `v` prefix — Obsidian's convention)
# and publishes the GitHub release with the plugin artifacts.
#
# It is idempotent: a push to `main` that does NOT bump the version (e.g. a CI
# or docs change) finds the tag already exists and does nothing. Tag + release
# happen in the same job, so we don't rely on a tag push triggering a second
# workflow (GITHUB_TOKEN tag pushes don't trigger other workflows).
on:
  push:
    branches: [main]

permissions:
  contents: write

concurrency:
  group: release-main
  cancel-in-progress: false

jobs:
  release:
    name: release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write # mint the provenance signing certificate
      attestations: write # write the artifact attestation
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "20"
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      - name: Lint (eslint-plugin-obsidianmd)
        run: npm run lint

      - name: Type-check & build (tsc --noEmit + esbuild)
        run: npm run build

      - name: Validate
        run: |
          node --check main.js
          node scripts/validate.mjs

      - name: Read version from manifest
        id: meta
        run: echo "version=$(node -p "require('./manifest.json').version")" >> "$GITHUB_OUTPUT"

      - name: Check whether this version is already released
        id: guard
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          V="${{ steps.meta.outputs.version }}"
          if gh release view "$V" >/dev/null 2>&1 \
             || [ -n "$(git ls-remote --tags origin "refs/tags/$V")" ]; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
            echo "Version $V already released or tagged — nothing to do."
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
            echo "Version $V is new — will tag and release."
          fi

      - name: Tag the release commit
        if: steps.guard.outputs.exists == 'false'
        run: |
          V="${{ steps.meta.outputs.version }}"
          git tag "$V"
          git push origin "$V"

      # Cryptographically attest that these assets were built from this repo by
      # this workflow, so users can verify provenance with `gh attestation verify`.
      - name: Attest build provenance
        if: steps.guard.outputs.exists == 'false'
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: |
            main.js
            styles.css

      - name: Create GitHub release
        if: steps.guard.outputs.exists == 'false'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          V="${{ steps.meta.outputs.version }}"
          gh release create "$V" \
            main.js manifest.json styles.css \
            --title "Lookout $V" \
            --generate-notes