git.iko.soy/diagonal
on master help sign in
diagonal/.github/workflows/release.yml
105 lines 4.7 kB history raw
1name: Release
3# Every push to master builds the extension and publishes it as a GitHub release.
4# The version is the commit's timestamp in UTC, YYYY.MM.DD.HHMM, used as the tag and release name.
5on:
6 push:
7 branches: [master]
9permissions:
10 contents: write
12# One release at a time, in push order: an older run finishing last must not become the latest release,
13# which is what the Homebrew cask downloads.
14concurrency:
15 group: release
16 cancel-in-progress: false
18jobs:
19 release:
20 runs-on: ubuntu-latest
21 steps:
22 - uses: actions/checkout@v4
24 - uses: actions/setup-node@v4
25 with:
26 node-version: 22
27 cache: npm
29 - uses: actions/setup-python@v5
30 with:
31 python-version: "3.12"
33 - name: Install dependencies
34 run: npm ci
36 - name: Version from commit time
37 id: version
38 env:
39 GH_TOKEN: ${{ github.token }}
40 run: |
41 # The commit's minute, or the next free minute when another commit already released in it. A re-run
42 # for a commit that already released publishes nothing: a rebuilt zip has new bytes, which would
43 # break the sha256 the tap already has, and users on that version would never get the new one.
44 t=$(git log -1 --format=%ct "$GITHUB_SHA")
45 for _ in $(seq 1 30); do
46 version=$(date -u -d "@$t" +%Y.%m.%d.%H%M)
47 target=$(gh release view "$version" --json targetCommitish -q .targetCommitish 2>/dev/null || true)
48 [ -z "$target" ] && break
49 if [ "$target" = "$GITHUB_SHA" ]; then
50 echo "published=true" >> "$GITHUB_OUTPUT"
51 break
52 fi
53 t=$((t + 60))
54 done
55 echo "version=$version" >> "$GITHUB_OUTPUT"
56 echo "Version $version"
58 - name: Typecheck and test
59 run: npm run check
61 - name: Build
62 env:
63 DIAGONAL_VERSION: ${{ steps.version.outputs.version }}
64 run: |
65 npm run build
66 (cd dist && zip -qr "../diagonal-extension-${DIAGONAL_VERSION}.zip" .)
67 # Same zip under a fixed name: releases/latest/download/diagonal-extension.zip is what the
68 # Homebrew cask (iko-soy/homebrew-tap, Casks/diagonal.rb) downloads.
69 cp "diagonal-extension-${DIAGONAL_VERSION}.zip" diagonal-extension.zip
70 cat dist/manifest.json | head -5
71 # The Chrome Web Store package: no pinned key, no bundled host (docs/store/listing.md).
72 npm run zip:store
74 - name: Publish release
75 if: steps.version.outputs.published != 'true'
76 env:
77 GH_TOKEN: ${{ github.token }}
78 VERSION: ${{ steps.version.outputs.version }}
79 run: |
80 asset="diagonal-extension-${VERSION}.zip"
81 notes="Built from ${GITHUB_SHA::7}. Install with: brew install iko-soy/tap/diagonal. Or by hand: unzip, load the folder at brave://extensions (Developer mode → Load unpacked), then install the native host once from Terminal: bash <that folder>/install-host.command"
82 gh release create "$VERSION" "$asset" diagonal-extension.zip diagonal-store.zip --target "$GITHUB_SHA" --title "Diagonal $VERSION" --notes "$notes" --latest
84 # Uploads the release to the Chrome Web Store and submits it for review, once the listing exists and
85 # its API credentials are set as repository secrets (docs/store/listing.md). Skipped until then.
86 - name: Upload to the Chrome Web Store
87 if: steps.version.outputs.published != 'true'
88 env:
89 CWS_EXTENSION_ID: ${{ secrets.CWS_EXTENSION_ID }}
90 CWS_CLIENT_ID: ${{ secrets.CWS_CLIENT_ID }}
91 CWS_CLIENT_SECRET: ${{ secrets.CWS_CLIENT_SECRET }}
92 CWS_REFRESH_TOKEN: ${{ secrets.CWS_REFRESH_TOKEN }}
93 run: |
94 if [ -z "$CWS_EXTENSION_ID" ] || [ -z "$CWS_REFRESH_TOKEN" ]; then
95 echo "Chrome Web Store secrets not set; skipping upload."
96 exit 0
97 fi
98 token=$(curl -fsS https://oauth2.googleapis.com/token \
99 -d client_id="$CWS_CLIENT_ID" -d client_secret="$CWS_CLIENT_SECRET" \
100 -d refresh_token="$CWS_REFRESH_TOKEN" -d grant_type=refresh_token | jq -r .access_token)
101 curl -fsS -X PUT -H "Authorization: Bearer $token" -H "x-goog-api-version: 2" \
102 -T diagonal-store.zip "https://www.googleapis.com/upload/chromewebstore/v1.1/items/$CWS_EXTENSION_ID" | tee upload.json
103 jq -e '.uploadState == "SUCCESS"' upload.json
104 curl -fsS -X POST -H "Authorization: Bearer $token" -H "x-goog-api-version: 2" -H "Content-Length: 0" \
105 "https://www.googleapis.com/chromewebstore/v1.1/items/$CWS_EXTENSION_ID/publish" | tee publish.json