purpur-ignis/.gitea/workflows/release.yml

name: Release

on:
  push:
    branches: [main]

concurrency:
  group: ignis-release
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.RELEASE_TOKEN }}
          persist-credentials: false

      - name: Set up Java
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 25
          cache: gradle

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Build and test before release
        run: ./gradlew clean check

      - name: Resolve semantic version and tag
        id: release
        env:
          IGNIS_RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
          GITEA_SERVER_URL: ${{ github.server_url }}
          REPOSITORY: ${{ github.repository }}
        shell: bash
        run: |
          set -euo pipefail
          test -n "$IGNIS_RELEASE_TOKEN" || { echo 'RELEASE_TOKEN is required'; exit 1; }
          test "$GITEA_SERVER_URL" = 'https://git.garvis.dev'
          test "$REPOSITORY" = 'dmg/purpur-ignis'
          # semantic-release overrides GIT_ASKPASS; use Git's credential protocol instead.
          # Token stays in environment/credential stdout, never in the remote URL or argv.
          export GIT_TERMINAL_PROMPT=0
          git config credential.helper ''
          git config --add credential.helper "$PWD/.gitea/scripts/git-credential-ignis.sh"
          git config credential.useHttpPath true
          trap 'git config --unset-all credential.helper || true; git config --unset credential.useHttpPath || true' EXIT
          git remote set-url origin "${GITEA_SERVER_URL}/${REPOSITORY}.git"
          previous=$(git describe --tags --abbrev=0 2>/dev/null || true)
          npx -y \
            -p semantic-release@24.2.9 \
            -p @semantic-release/commit-analyzer@13.0.1 \
            -p @semantic-release/release-notes-generator@14.1.0 \
            semantic-release --branches main \
            --repository-url "${GITEA_SERVER_URL}/${REPOSITORY}.git" \
            --plugins @semantic-release/commit-analyzer,@semantic-release/release-notes-generator
          current=$(git describe --tags --exact-match HEAD 2>/dev/null || true)
          if [ -n "$current" ] && [ "$current" != "$previous" ]; then
            [[ "$current" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
            echo 'created=true' >> "$GITHUB_OUTPUT"
            echo "tag=$current" >> "$GITHUB_OUTPUT"
            echo "version=${current#v}" >> "$GITHUB_OUTPUT"
            echo "previous=$previous" >> "$GITHUB_OUTPUT"
          else
            echo 'created=false' >> "$GITHUB_OUTPUT"
          fi

      - name: Build versioned plugin
        if: steps.release.outputs.created == 'true'
        env:
          VERSION: ${{ steps.release.outputs.version }}
        run: ./gradlew clean jar -PreleaseVersion="$VERSION"

      - name: Upload release workflow artifact
        if: steps.release.outputs.created == 'true'
        uses: actions/upload-artifact@v3
        with:
          name: purpur-ignis-${{ steps.release.outputs.version }}
          path: build/libs/purpur-ignis-${{ steps.release.outputs.version }}.jar
          if-no-files-found: error

      - name: Publish versioned Gitea asset
        if: steps.release.outputs.created == 'true'
        env:
          IGNIS_RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
          GITEA_SERVER_URL: ${{ github.server_url }}
          REPOSITORY: ${{ github.repository }}
          TAG: ${{ steps.release.outputs.tag }}
          VERSION: ${{ steps.release.outputs.version }}
          PREVIOUS_TAG: ${{ steps.release.outputs.previous }}
        shell: bash
        run: |
          set -euo pipefail
          test "$GITEA_SERVER_URL" = 'https://git.garvis.dev'
          test "$REPOSITORY" = 'dmg/purpur-ignis'
          api_url="${GITEA_SERVER_URL}/api/v1/repos/${REPOSITORY}/releases"
          jar="build/libs/purpur-ignis-${VERSION}.jar"
          payload=$(mktemp)
          response=$(mktemp)
          trap 'rm -f "$payload" "$response"' EXIT
          export RELEASE_BODY
          if [ -n "$PREVIOUS_TAG" ]; then
            RELEASE_BODY=$(git log --pretty='format:- %s (%h)' "${PREVIOUS_TAG}..HEAD")
          else
            RELEASE_BODY=$(git log --pretty='format:- %s (%h)' HEAD)
          fi
          node -e 'process.stdout.write(JSON.stringify({tag_name: process.env.TAG, name: process.env.TAG,
            body: process.env.RELEASE_BODY, draft: false, prerelease: false}))' > "$payload"
          # printf is a shell builtin. Curl reads the authorization header from stdin, never argv.
          printf 'Authorization: token %s\n' "$IGNIS_RELEASE_TOKEN" | \
            curl --fail --silent --show-error --max-time 60 --proto '=https' \
              --header @- --header 'Content-Type: application/json' \
              --data-binary "@$payload" --output "$response" "$api_url"
          release_id=$(node -e 'const fs=require("node:fs"); const r=JSON.parse(fs.readFileSync(process.argv[1],"utf8"));
            if(!Number.isSafeInteger(r.id)||r.id<=0) process.exit(1); process.stdout.write(String(r.id));' "$response")
          printf 'Authorization: token %s\n' "$IGNIS_RELEASE_TOKEN" | \
            curl --fail --silent --show-error --max-time 120 --proto '=https' \
              --header @- --header 'Content-Type: application/octet-stream' \
              --data-binary "@$jar" --output /dev/null \
              "${api_url}/${release_id}/assets?name=purpur-ignis-${VERSION}.jar"