release.yml

name: 🚀 » release and publish
run-name: 🚀 » release and publish
on:
  workflow_dispatch:
    inputs:
      versionChange:
        type: choice
        description: Select the version change
        required: true
        default: "minor"
        options:
          - major
          - minor
          - patch

permissions:
  id-token: write
  contents: read
  attestations: write

jobs:
  release:
    runs-on: ubuntu-latest
    env:
      VERSION_CHANGE: ${{ github.event.inputs.versionChange }}

    permissions:
      contents: write
      id-token: write
      attestations: write

    steps:
      - name: Checkout 🛎️
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
        with:
          fetch-depth: 0

      - name: Setup Platform 🛠
        uses: oven-sh/setup-bun@4bc047ad259df6fc24a6c9b0f9a0cb08cf17fbe5 # v2
        with:
          bun-version-file: ".bun-version"

      - name: 📦 Install dependencies
        run: |
          bun install --frozen-lockfile
          bun add -g npm

      - name: 🔄 Update version
        run: |
          git status
          git config --global user.name 'Lucas Colombo'
          git config --global user.email 'lucasncolombo@gmail.com'
          git config --global push.followTags true
          bun run build
          npm version ${{ env.VERSION_CHANGE }} -m "release: 🔖 v%s"

      - name: 🛠️ Build
        run: bunx @vscode/vsce package

      - name: 📝 Get metadata
        run: |
          VERSION=$(bun --print "(await import('./package.json')).version")
          NAME=$(bun --print "(await import('./package.json')).name")
          DISPLAY_NAME=$(bun --print "(await import('./package.json')).displayName")
          echo VERSION=$VERSION >> $GITHUB_ENV
          echo NAME=$NAME >> $GITHUB_ENV
          echo DISPLAY_NAME=$DISPLAY_NAME >> $GITHUB_ENV

      - name: Attest artifacts ✅
        uses: actions/attest@2da0b136720d14f01f4dbeeafd1d5a4d76cbe21d # v1.4.0
        # Read: https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds
        with:
          subject-path: '${{ env.NAME }}-${{ env.VERSION }}.vsix'
          predicate-type: 'https://in-toto.io/attestation/release'
          predicate: '{}'

      - name: 📌 Push tags
        run: git push

      - name: 🚀 Release ${{ env.VERSION }}
        uses: softprops/action-gh-release@01570a1f39cb168c169c802c3bceb9e93fb10974 # v2.1.0
        with:
          files: ${{ env.NAME }}-${{ env.VERSION }}.vsix
          tag_name: v${{ env.VERSION }}
          name: ${{ env.DISPLAY_NAME }} v${{ env.VERSION }}
          generate_release_notes: true

      - name: 🌐 Publish to Open VSX Registry
        uses: HaaLeo/publish-vscode-extension@28e2d3f5817fccf23c1f219eb0cecc903132d1a2 # v1.6.2
        # disable for now
        if: ${{ false }}
        with:
          pat: ${{ secrets.OPEN_VSX_TOKEN }}
          extensionFile: ${{ env.NAME }}-${{ env.VERSION }}.vsix

      - name: Publish to Visual Studio Marketplace 🚀
        uses: HaaLeo/publish-vscode-extension@28e2d3f5817fccf23c1f219eb0cecc903132d1a2 # v1.6.2
        with:
          pat: ${{ secrets.VS_MARKETPLACE_TOKEN }}
          registryUrl: https://marketplace.visualstudio.com
          extensionFile: ${{ env.NAME }}-${{ env.VERSION }}.vsix

      - name: Publish to NPM Registry 🌐
        run: npm publish
        if: ${{ false }}
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}