release.yml

name: Create release and publish to github, npm and docker hub

# Reusable workflow invoked by release-please.yml once a plugin-validator
# release has been drafted. It is NOT triggered by tag pushes: with GitHub's
# immutable releases enabled, release-please creates the GitHub release as a
# *draft* (which does not push a git tag and does not fire a `release` event),
# so GoReleaser is driven from release-please's outputs instead. GoReleaser
# adopts the draft, uploads the binaries, and then publishes it.
on: # zizmor: ignore[cache-poisoning]
  workflow_call:
    inputs:
      tag_name:
        description: Release tag, e.g. plugin-validator/v0.42.7
        required: true
        type: string
      sha:
        description: Commit SHA the release points at
        required: true
        type: string
  workflow_dispatch:
    inputs:
      tag_name:
        description: Release tag, e.g. plugin-validator/v0.42.7
        required: true
        type: string
      sha:
        description: Commit SHA the release points at
        required: true
        type: string

jobs:
  release-to-github:
    runs-on: ubuntu-arm64
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.sha }}
          fetch-depth: 0
          persist-credentials: false

      - run: git fetch --force --tags
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
          check-latest: true
          # This is a publishing workflow; disable the Go cache so a cache
          # entry poisoned from a less-trusted context can't influence the
          # released binaries (zizmor cache-poisoning).
          cache: false

      - name: Generate token
        id: generate_token
        uses: grafana/shared-workflows/actions/create-github-app-token@46f48da11e78ebdba7a8747ae456b11062fac83e # create-github-app-token/v0.3.1
        with:
          github_app: grafana-plugins-platform-bot

      - name: Extract release version
        env:
          TAG_NAME: ${{ inputs.tag_name }}
        run: echo "RELEASE_VERSION=${TAG_NAME#plugin-validator/v}" >> "$GITHUB_ENV"

      - name: Ensure a single release-please draft to adopt
        env:
          # gh reads the token from GH_TOKEN. The App has contents:read, which is
          # required to see *draft* releases — they are not returned to anonymous
          # callers.
          GH_TOKEN: ${{ steps.generate_token.outputs.token }}
          GH_REPO: ${{ github.repository }}
          TAG_NAME: ${{ inputs.tag_name }}
        run: |
          # GoReleaser adopts release-please's *draft* release (use_existing_draft
          # in .goreleaser.yaml). If that draft is missing at runtime, GoReleaser
          # silently creates a brand-new release instead — which is how a
          # failed/retried publish produced two releases for the same tag (an
          # orphaned draft plus a published release with no notes). Decide before
          # handing off to GoReleaser:
          #   * a published (non-draft) release already exists -> the publish
          #     already happened; skip GoReleaser so a re-run can't duplicate it.
          #   * exactly one draft exists -> proceed; GoReleaser adopts it.
          #   * zero (or multiple) drafts -> fail fast instead of guessing.
          # Releases are returned newest-first, so the just-created ones are on
          # the first page. gh's built-in --jq reads $TAG_NAME via jq's `env`.
          published="$(gh api "repos/${GH_REPO}/releases?per_page=100" \
            --jq '[.[] | select(.tag_name == env.TAG_NAME and (.draft | not))] | length')"
          drafts="$(gh api "repos/${GH_REPO}/releases?per_page=100" \
            --jq '[.[] | select(.tag_name == env.TAG_NAME and .draft)] | length')"
          echo "For ${TAG_NAME}: drafts=${drafts}, published=${published}"
          if [ "$published" -gt 0 ]; then
            echo "::warning::A published release for ${TAG_NAME} already exists; skipping GoReleaser to avoid creating a duplicate."
            echo "skip_goreleaser=true" >> "$GITHUB_ENV"
          elif [ "$drafts" -eq 0 ]; then
            echo "::error::No release-please draft found for ${TAG_NAME}; refusing to let GoReleaser create a new release."
            exit 1
          elif [ "$drafts" -gt 1 ]; then
            echo "::error::Found ${drafts} draft releases for ${TAG_NAME}; resolve the duplicates before publishing."
            exit 1
          fi

      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
        if: env.skip_goreleaser != 'true'
        with:
          distribution: goreleaser
          # Temporary pin until the missing-tag regression in v2.18.1 is released.
          version: v2.18.2
          # release-please tags look like `plugin-validator/v0.42.0`, which
          # GoReleaser's validate pipe can't parse as semver. Skip it; the
          # archive name template uses `RELEASE_VERSION` directly and
          # `release.mode: keep-existing` preserves release-please's notes.
          args: release --clean --skip=validate
        env:
          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
          RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
          GORELEASER_CURRENT_TAG: ${{ inputs.tag_name }}

  release-to-npm:
    runs-on: ubuntu-latest
    needs: release-to-github
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.sha }}
          persist-credentials: false

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"
      # Staged publishing requires npm >= 11.15.0, newer than the npm bundled
      # with Node 24.
      - run: npm install -g npm@latest
      - run: npm install
      - run: npm stage publish

      - name: Notify Slack about staged npm package
        uses: grafana/shared-workflows/actions/send-slack-message@551bc8d50017d3e95d5da3f8a4826e733a208dc0 # send-slack-message/v3.0.2
        with:
          method: chat.postMessage
          payload: |
            {
              "channel": "C0BNRK96T24",
              "text": "📦 `@grafana/plugin-validator` has been staged for npm publishing from tag `${{ inputs.tag_name }}`. Please review and approve at https://www.npmjs.com/settings/grafanabot/staged-packages"
            }

  release-to-dockerhub:
    runs-on: ubuntu-x64
    # this job doesn't really need the github release, but it is a fast
    # way to prevent it from running if the release is bad
    needs: release-to-github
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.sha }}
          persist-credentials: false

      - name: Get version from package.json
        id: get_version
        run: |
          echo "version=$(jq -r .version package.json)" >> "$GITHUB_OUTPUT"

      - id: push-to-gar
        uses: grafana/shared-workflows/actions/docker-build-push-image@c66d74df41cf4ed28a90da1d91c263f9d1609a21 # docker-build-push-image/v0.3.4
        with:
          registries: gar
          gar-environment: prod
          gar-repository: dockerhub-plugin-validator-prod-mirror
          gar-image: plugin-validator-cli
          context: .
          tags: |-
            "v${{ steps.get_version.outputs.version }}"
            "latest"
          push: true
          # Disable the build cache (the action defaults cache-from/to to
          # type=gha): a cache seeded from a less-trusted context (e.g. a PR)
          # must not be able to influence the published image (cache poisoning).
          cache-from: ""
          cache-to: ""