vscode-extension-release.yml

name: Release VS Code extension

on:
  workflow_dispatch:
    inputs:
      candidate_sha:
        description: Exact 40-character branch-head commit SHA to release
        required: true
        type: string
      dry_run:
        description: Validate full CI and VSIX artifacts without tagging or publishing
        required: false
        default: false
        type: boolean

concurrency:
  group: ${{ github.workflow }}-${{ github.run_id }}
  cancel-in-progress: false

permissions:
  contents: read
  actions: read

jobs:
  full-coverage:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.candidate_sha }}
      - name: Require exact-SHA full release CI before tagging
        env:
          GH_TOKEN: ${{ github.token }}
          EXPECTED_SHA: ${{ inputs.candidate_sha }}
        run: |
          [[ "$EXPECTED_SHA" =~ ^[0-9a-f]{40}$ ]]
          [[ "$GITHUB_REF" == refs/heads/* ]]
          test "$EXPECTED_SHA" = "$GITHUB_SHA"
          test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"
          python ci/verify_full_coverage.py --sha "$EXPECTED_SHA"

  validate-version:
    needs: [full-coverage]
    runs-on: ubuntu-24.04
    outputs:
      version: ${{ steps.version.outputs.version }}
      tag: ${{ steps.version.outputs.tag }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.candidate_sha }}
      - id: version
        env:
          EXPECTED_SHA: ${{ inputs.candidate_sha }}
        run: |
          test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"
          VERSION=$(node -p "require('./vscode-plugin/package.json').version")
          TAG="vscode-v${VERSION}"
          if git ls-remote --exit-code --tags origin "refs/tags/${TAG}" >/dev/null 2>&1; then
            git fetch --no-tags origin "refs/tags/${TAG}:refs/tags/${TAG}"
            test "$(git rev-parse "${TAG}^{commit}")" = "$EXPECTED_SHA" || {
              echo "Existing tag ${TAG} points to another commit" >&2
              exit 1
            }
          fi
          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"

  build:
    needs: [full-coverage, validate-version]
    if: needs.full-coverage.result == 'success' && needs.validate-version.result == 'success'
    uses: ./.github/workflows/vscode-extension.yml
    with:
      release_build: true

  artifact-preflight:
    needs: [full-coverage, validate-version, build]
    if: needs.full-coverage.result == 'success' && needs.validate-version.result == 'success' && needs.build.result == 'success'
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.candidate_sha }}
      - uses: actions/download-artifact@v4
        with: { pattern: vscode-*, path: artifacts, merge-multiple: true }
      - name: Validate the seven VSIX packages before tagging
        env:
          VERSION: ${{ needs.validate-version.outputs.version }}
          EXPECTED_SHA: ${{ inputs.candidate_sha }}
        run: |
          test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"
          python ci/vscode_release_artifact_lint.py --artifacts artifacts --version "$VERSION"

  create-tag:
    needs: [full-coverage, validate-version, artifact-preflight]
    if: >-
      !cancelled() &&
      inputs.dry_run != true &&
      needs.full-coverage.result == 'success' &&
      needs.validate-version.result == 'success' &&
      needs.artifact-preflight.result == 'success'
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.candidate_sha }}
      - name: Create release tag from the verified commit
        env:
          EXPECTED_SHA: ${{ inputs.candidate_sha }}
          TAG: ${{ needs.validate-version.outputs.tag }}
        run: |
          test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"
          git config --local user.email "action@github.com"
          git config --local user.name "GitHub Action"
          if git ls-remote --exit-code --tags origin "refs/tags/${TAG}" >/dev/null 2>&1; then
            git fetch --no-tags origin "refs/tags/${TAG}:refs/tags/${TAG}"
            test "$(git rev-parse "${TAG}^{commit}")" = "$EXPECTED_SHA" || {
              echo "Existing tag ${TAG} points to another commit" >&2
              exit 1
            }
          else
            git tag -a "$TAG" -m "Release VS Code ${{ needs.validate-version.outputs.version }}"
            git push origin "refs/tags/${TAG}"
          fi

  publish:
    needs: [full-coverage, validate-version, artifact-preflight, create-tag]
    if: >-
      !cancelled() &&
      inputs.dry_run != true &&
      needs.full-coverage.result == 'success' &&
      needs.artifact-preflight.result == 'success' &&
      needs.create-tag.result == 'success'
    runs-on: ubuntu-24.04
    permissions:
      contents: write
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.candidate_sha }}
      - uses: actions/download-artifact@v4
        with: { pattern: vscode-*, path: artifacts, merge-multiple: true }
      - name: Verify release artifacts again
        env:
          VERSION: ${{ needs.validate-version.outputs.version }}
          EXPECTED_SHA: ${{ inputs.candidate_sha }}
        run: |
          test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"
          python ci/vscode_release_artifact_lint.py --artifacts artifacts --version "$VERSION"
      - name: Produce checksums
        run: |
          cd artifacts
          sha256sum *.vsix > SHA256SUMS.txt
      - uses: actions/attest-build-provenance@v2
        with:
          subject-path: artifacts/*.vsix
      - name: Create GitHub release from the verified package bytes
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ needs.validate-version.outputs.tag }}
          VERSION: ${{ needs.validate-version.outputs.version }}
        run: gh release create "$TAG" artifacts/* --title "FastLED VS Code $VERSION" --generate-notes
      - name: Publish those same prebuilt VSIX files to Marketplace
        env:
          VSCE_PAT: ${{ secrets.VSCE_PAT }}
        run: |
          test -n "$VSCE_PAT"
          for vsix in artifacts/*.vsix; do npx --yes @vscode/vsce@3.6.2 publish --packagePath "$vsix" --pat "$VSCE_PAT"; done