release.yml

name: 🚀 Release

on:
  workflow_dispatch:

env:
  NODE_VERSION: 20
  PNPM_VERSION: 9

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Checkout project
        uses: actions/checkout@v4

      - name: Check version
        id: meta
        run: |
          VERSION=$(jq -r .version manifest.json)
          echo "version=${VERSION}" >> $GITHUB_OUTPUT

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: ${{ env.PNPM_VERSION }}
          run_install: true

      - name: Build package
        run: pnpm build

      - name: Sign package
        working-directory: dist
        run: |
          if [[ -z "${{ secrets.PRIVATE_KEY }}" ]]; then
            echo "Set an ed25519 key as PRIVATE_KEY in GitHub Action secret to sign."
          else
            echo "${{ secrets.PRIVATE_KEY }}" > private_key.pem
            openssl pkeyutl -sign -inkey private_key.pem -out plugin_package.zip.sig -rawin -in plugin_package.zip
            rm private_key.pem
          fi

      - name: Create release
        uses: ncipollo/release-action@v1
        with:
          tag: ${{ steps.meta.outputs.version }}
          commit: ${{ github.sha }}
          body: 'Release ${{ steps.meta.outputs.version }}'
          artifacts: 'dist/plugin_package.zip,dist/plugin_package.zip.sig'