action.yml

# Bump plugin.json, then commit, tag, and release it. Dry runs stop before commit.

name: "Binary Ninja Plugin Release"
description: "Bump plugin.json and publish a tagged GitHub release."
author: "Vector 35"

branding:
  icon: "package"
  color: "blue"

inputs:
  version:
    description: "Version; blank increments the last component."
    required: false
    default: ""
  description:
    description: "Release notes; blank generates them."
    required: false
    default: ""
  plugin-json:
    description: "Path to the plugin manifest, relative to the repository root."
    required: false
    default: "plugin.json"
  token:
    description: "Push and release token."
    required: false
    default: ${{ github.token }}
  checkout:
    description: "Check out the default branch and all tags."
    required: false
    default: "true"
  dry-run:
    description: "Validate without committing or publishing."
    required: false
    default: "false"

outputs:
  version:
    description: "The version written to plugin.json (e.g. 1.3.6)."
    value: ${{ steps.prepare.outputs.version }}
  previous:
    description: "The version that was in plugin.json before this run."
    value: ${{ steps.prepare.outputs.previous }}
  tag:
    description: "Release tag; equal to version."
    value: ${{ steps.prepare.outputs.tag }}
  url:
    description: "URL of the published release. Empty on a dry run."
    value: ${{ steps.publish.outputs.url }}

runs:
  using: "composite"
  steps:
    - name: Resolve the default branch
      id: repo
      shell: bash
      env:
        GH_TOKEN: ${{ inputs.token }}
        PAYLOAD_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
      run: |
        set -euo pipefail
        branch="$PAYLOAD_DEFAULT_BRANCH"
        if [ -z "$branch" ]; then
          branch="$(gh api "repos/$GITHUB_REPOSITORY" --jq .default_branch)"
        fi
        if [ -z "$branch" ]; then
          echo "::error::Could not determine the default branch of $GITHUB_REPOSITORY."
          exit 1
        fi
        echo "Releasing from the default branch: $branch"
        echo "default_branch=$branch" >> "$GITHUB_OUTPUT"

    - name: Check out the default branch
      if: inputs.checkout == 'true'
      uses: actions/checkout@v7
      with:
        ref: ${{ steps.repo.outputs.default_branch }}
        fetch-depth: 0
        token: ${{ inputs.token }}
        persist-credentials: true

    - name: Verify the caller's checkout
      if: inputs.checkout != 'true'
      shell: bash
      env:
        DEFAULT_BRANCH: ${{ steps.repo.outputs.default_branch }}
        DRY_RUN: ${{ inputs.dry-run }}
      run: |
        set -euo pipefail
        if [ "$(git rev-parse --is-shallow-repository)" = "true" ]; then
          echo "::error::Checkout is shallow; use fetch-depth: 0 or checkout: true."
          exit 1
        fi
        current="$(git rev-parse --abbrev-ref HEAD)"
        if [ "$current" != "$DEFAULT_BRANCH" ]; then
          if [ "$DRY_RUN" = "true" ]; then
            echo "::warning::HEAD is $current, not $DEFAULT_BRANCH; only dry-run is allowed."
          else
            echo "::error::HEAD is $current; releases require $DEFAULT_BRANCH."
            exit 1
          fi
        fi

    - name: Normalize plugin.json and resolve the new version
      id: prepare
      shell: bash
      env:
        PLUGIN_JSON: ${{ inputs.plugin-json }}
        # Passed through the environment rather than interpolated into the
        # command line, so a funny value can never become shell code.
        INPUT_VERSION: ${{ inputs.version }}
        ACTION_PATH: ${{ github.action_path }}
        GH_TOKEN: ${{ inputs.token }}
      run: |
        set -euo pipefail
        python3 "$ACTION_PATH/scripts/prepare_release.py" \
          --plugin-json "$PLUGIN_JSON" \
          --version "$INPUT_VERSION"
        git --no-pager diff -- "$PLUGIN_JSON"

    - name: Commit and push the version bump
      if: inputs.dry-run != 'true' && steps.prepare.outputs.recovered != 'true'
      shell: bash
      env:
        PLUGIN_JSON: ${{ inputs.plugin-json }}
        NEW_VERSION: ${{ steps.prepare.outputs.version }}
        DEFAULT_BRANCH: ${{ steps.repo.outputs.default_branch }}
      run: |
        set -euo pipefail
        git config user.name "github-actions[bot]"
        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
        git add -- "$PLUGIN_JSON"
        git commit --only -m "Version $NEW_VERSION" -- "$PLUGIN_JSON"
        git push origin "HEAD:refs/heads/$DEFAULT_BRANCH"

    - name: Tag the bump commit and publish the release
      id: publish
      if: inputs.dry-run != 'true'
      shell: bash
      env:
        GH_TOKEN: ${{ inputs.token }}
        NEW_VERSION: ${{ steps.prepare.outputs.version }}
        TAG: ${{ steps.prepare.outputs.tag }}
        RELEASE_DESCRIPTION: ${{ inputs.description }}
      run: |
        set -euo pipefail
        if git show-ref --verify --quiet "refs/tags/$TAG"; then
          if [ "$(git rev-list -n 1 "$TAG")" != "$(git rev-parse HEAD)" ]; then
            echo "::error::Tag $TAG does not point to the version commit."
            exit 1
          fi
        else
          git tag -a "$TAG" -m "Version $NEW_VERSION"
          git push origin "refs/tags/$TAG"
        fi

        if [ -n "$RELEASE_DESCRIPTION" ]; then
          notes=(--notes "$RELEASE_DESCRIPTION")
        else
          notes=(--generate-notes)
        fi

        if ! url="$(gh release view "$TAG" --json url --jq .url 2>/dev/null)"; then
          gh release create "$TAG" \
            --title "$NEW_VERSION" \
            --verify-tag \
            --latest \
            "${notes[@]}"
          url="${GITHUB_SERVER_URL:-https://github.com}/$GITHUB_REPOSITORY/releases/tag/$TAG"
        fi
        echo "url=$url" >> "$GITHUB_OUTPUT"

        {
          echo "### Released $NEW_VERSION"
          echo ""
          echo "- plugin.json: \`$NEW_VERSION\`"
          echo "- tag: \`$TAG\` (naming is convention only)"
          echo "- $url"
        } >> "$GITHUB_STEP_SUMMARY"

    - name: Report the dry run
      if: inputs.dry-run == 'true'
      shell: bash
      env:
        NEW_VERSION: ${{ steps.prepare.outputs.version }}
        PREVIOUS: ${{ steps.prepare.outputs.previous }}
      run: |
        set -euo pipefail
        {
          echo "### Dry run: nothing was committed, tagged or published"
          echo ""
          echo "A real run would have released \`$PREVIOUS\` -> \`$NEW_VERSION\`."
          echo ""
          echo "Manifest changes are local to this runner."
        } >> "$GITHUB_STEP_SUMMARY"