release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      version:
        description: Optional release version guard without leading v; must match Version.props.
        required: false
  push:
    tags:
      - 'v*'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  version:
    # Gate before checkout: manual dispatch must not run arbitrary refs on White.
    if: >-
      github.repository == 'krotname/NppMarkdownTableEditor' &&
      github.actor == github.repository_owner && github.triggering_actor == github.repository_owner &&
      (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/v'))
    runs-on: ${{ fromJSON(vars.CI_WINDOWS_RUNS_ON || '["self-hosted","Windows","X64","adler-white-npp","adler-black-ephemeral"]') }}
    timeout-minutes: 10
    outputs:
      version: ${{ steps.version.outputs.version }}
      tag: ${{ steps.version.outputs.tag }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Resolve version
        id: version
        shell: pwsh
        run: |
          [xml]$versionProps = Get-Content -LiteralPath "Version.props"
          $versionParts = $versionProps.Project.PropertyGroup
          $canonicalVersion = "$($versionParts.MarkdownTableEditorVersionMajor.InnerText).$($versionParts.MarkdownTableEditorVersionMinor.InnerText).$($versionParts.MarkdownTableEditorVersionPatch.InnerText)"

          $requestedVersion = "${{ github.event.inputs.version }}"
          if (-not $requestedVersion -and "${{ github.ref_type }}" -eq "tag") {
            $requestedVersion = "${{ github.ref_name }}".TrimStart("v")
          }
          if ($requestedVersion -and $requestedVersion -ne $canonicalVersion) {
            throw "Release version '$requestedVersion' does not match Version.props '$canonicalVersion'. Update Version.props first."
          }

          "version=$canonicalVersion" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
          "tag=v$canonicalVersion" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append

  build:
    needs: version
    # A manual dispatch runs the workflow file and the build scripts of whatever ref was picked,
    # so release binaries are built from trusted refs only: the default branch and release tags.
    # Any other ref skips this job, and the release job that depends on it is skipped with it.
    if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/v')
    runs-on: ${{ fromJSON(vars.CI_WINDOWS_RUNS_ON || '["self-hosted","Windows","X64","adler-white-npp","adler-black-ephemeral"]') }}
    timeout-minutes: 90
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: Win32
            label: x86
          - platform: x64
            label: x64
          - platform: ARM64
            label: arm64
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Add msbuild to PATH
        uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3

      - name: Ensure ARM64 C++ build tools
        if: matrix.platform == 'ARM64'
        shell: pwsh
        run: .\scripts\Ensure-VsArm64Tools.ps1

      - name: Build package
        run: msbuild Package.proj /m "/t:Package;CorePerformance" /p:Configuration=Release /p:Platform="${{ matrix.platform }}"
        if: matrix.platform == 'x64'

      - name: Build package
        run: msbuild Package.proj /m /t:Package /p:Configuration=Release /p:Platform="${{ matrix.platform }}"
        if: matrix.platform != 'x64'

      - name: Upload package artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: notepad-${{ matrix.label }}
          path: |
            build/MarkdownTableEditor-${{ needs.version.outputs.version }}-${{ matrix.label }}.zip
            build/MarkdownTableEditor-${{ needs.version.outputs.version }}-${{ matrix.label }}-pluginadmin.zip
          if-no-files-found: error
          retention-days: 1

  compatibility-smoke:
    needs: version
    # Window and menu automation needs a desktop outside the container pool.
    runs-on: windows-latest
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Add msbuild to PATH
        uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3

      - name: Notepad++ compatibility smoke
        shell: pwsh
        env:
          GH_TOKEN: ${{ github.token }}
        run: msbuild Package.proj "/t:NppCompatibilitySmoke;NppLatestSmoke"

  release:
    needs:
      - version
      - build
      - compatibility-smoke
    runs-on: ${{ fromJSON(vars.CI_WINDOWS_RUNS_ON || '["self-hosted","Windows","X64","adler-white-npp","adler-black-ephemeral"]') }}
    timeout-minutes: 15
    permissions:
      contents: write
      id-token: write
      attestations: write
      artifact-metadata: write
    steps:
      # Only for docs/release-notes.md, which carries this version's release prose.
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout: docs/release-notes.md
          sparse-checkout-cone-mode: false

      - name: Download package artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: release-assets

      - name: Generate release checksums
        shell: bash
        env:
          VERSION: ${{ needs.version.outputs.version }}
        run: |
          mkdir -p release-files
          mapfile -t downloaded_files < <(find release-assets -type f -name '*.zip' | sort)
          if [ "${#downloaded_files[@]}" -eq 0 ]; then
            echo "No release ZIP files were downloaded." >&2
            exit 1
          fi

          for file in "${downloaded_files[@]}"; do
            cp "$file" "release-files/$(basename "$file")"
          done

          timestamp="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
          cat > "release-files/MarkdownTableEditor-$VERSION-sbom.cdx.json" <<EOF
          {
            "bomFormat": "CycloneDX",
            "specVersion": "1.6",
            "version": 1,
            "metadata": {
              "timestamp": "$timestamp",
              "component": {
                "type": "application",
                "name": "NppMarkdownTableEditor",
                "version": "$VERSION",
                "purl": "pkg:github/krotname/NppMarkdownTableEditor@v$VERSION"
              }
            }
          }
          EOF

          mapfile -t files < <(find release-files -maxdepth 1 -type f \( -name '*.zip' -o -name '*-sbom.cdx.json' \) | sort)
          sha256sum "${files[@]}" > SHA256SUMS.txt
          cat SHA256SUMS.txt

      - name: Generate release provenance attestation
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
        with:
          subject-path: |
            release-files/*.zip
            release-files/*-sbom.cdx.json
      - name: Publish GitHub release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          TAG_NAME: ${{ needs.version.outputs.tag }}
          VERSION: ${{ needs.version.outputs.version }}
        run: |
          mapfile -t files < <(find release-files -maxdepth 1 -type f \( -name '*.zip' -o -name '*-sbom.cdx.json' \) | sort)
          if [ "${#files[@]}" -eq 0 ]; then
            echo "No release ZIP files were downloaded." >&2
            exit 1
          fi
          cat > release-notes.md <<EOF
          ## Builds / Downloads

          - [MarkdownTableEditor-$VERSION-x86.zip](https://github.com/krotname/NppMarkdownTableEditor/releases/download/v$VERSION/MarkdownTableEditor-$VERSION-x86.zip)
          - [MarkdownTableEditor-$VERSION-x86-pluginadmin.zip](https://github.com/krotname/NppMarkdownTableEditor/releases/download/v$VERSION/MarkdownTableEditor-$VERSION-x86-pluginadmin.zip)
          - [MarkdownTableEditor-$VERSION-x64.zip](https://github.com/krotname/NppMarkdownTableEditor/releases/download/v$VERSION/MarkdownTableEditor-$VERSION-x64.zip)
          - [MarkdownTableEditor-$VERSION-x64-pluginadmin.zip](https://github.com/krotname/NppMarkdownTableEditor/releases/download/v$VERSION/MarkdownTableEditor-$VERSION-x64-pluginadmin.zip)
          - [MarkdownTableEditor-$VERSION-arm64.zip](https://github.com/krotname/NppMarkdownTableEditor/releases/download/v$VERSION/MarkdownTableEditor-$VERSION-arm64.zip)
          - [MarkdownTableEditor-$VERSION-arm64-pluginadmin.zip](https://github.com/krotname/NppMarkdownTableEditor/releases/download/v$VERSION/MarkdownTableEditor-$VERSION-arm64-pluginadmin.zip)
          - [MarkdownTableEditor-$VERSION-sbom.cdx.json](https://github.com/krotname/NppMarkdownTableEditor/releases/download/v$VERSION/MarkdownTableEditor-$VERSION-sbom.cdx.json)
          - [SHA256SUMS.txt](https://github.com/krotname/NppMarkdownTableEditor/releases/download/v$VERSION/SHA256SUMS.txt)
          EOF

          # The per-version prose lives in the repository, so a release can never ship the previous
          # version's notes: docs/release-notes.md is rewritten in the same commit that bumps
          # Version.props.
          if [ ! -s docs/release-notes.md ]; then
            echo "docs/release-notes.md is missing or empty; write this release's notes first." >&2
            exit 1
          fi
          printf '\n' >> release-notes.md
          # Drop the file's own title and instructions: keep from the first "## " heading on.
          sed '/^## /,$!d' docs/release-notes.md >> release-notes.md

          if gh release view "$TAG_NAME" --repo "$GITHUB_REPOSITORY" > /dev/null 2>&1; then
            gh release upload "$TAG_NAME" "${files[@]}" SHA256SUMS.txt --repo "$GITHUB_REPOSITORY" --clobber
            gh release edit "$TAG_NAME" --repo "$GITHUB_REPOSITORY" --title "Markdown Table Editor $VERSION" --notes-file release-notes.md --latest
          else
            gh release create "$TAG_NAME" "${files[@]}" SHA256SUMS.txt --repo "$GITHUB_REPOSITORY" --target "$GITHUB_SHA" --title "Markdown Table Editor $VERSION" --notes-file release-notes.md --latest
          fi