release.yml

name: Release tested plugin

on:
  workflow_run:
    workflows: [CI]
    types: [completed]
    branches: [bluff]

permissions:
  contents: write

concurrency:
  group: plugin-release
  cancel-in-progress: false

jobs:
  release:
    if: >-
      github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.event == 'push' &&
      github.event.workflow_run.head_branch == 'bluff' &&
      github.event.workflow_run.head_repository.full_name == github.repository
    runs-on: ubuntu-24.04
    steps:
      # Run trusted default-branch automation; release only the tested SHA.
      - uses: actions/checkout@v7
        with:
          ref: bluff
          fetch-depth: 0
          persist-credentials: false
      - name: Publish or resume the tested release
        id: release
        env:
          GH_TOKEN: ${{ github.token }}
          TESTED_COMMIT: ${{ github.event.workflow_run.head_sha }}
        run: bash scripts/release-tested.sh
      # Releases made with GITHUB_TOKEN do not trigger release-event workflows.
      - name: Notify nvim-config directly
        if: steps.release.outputs.tag != ''
        env:
          GH_TOKEN: ${{ secrets.NVIM_CONFIG_DISPATCH_TOKEN }}
          PLUGIN_COMMIT: ${{ github.event.workflow_run.head_sha }}
          PLUGIN_TAG: ${{ steps.release.outputs.tag }}
        run: |
          set -euo pipefail
          if [[ -z "${GH_TOKEN:-}" ]]; then
            echo "::error::Release published, but NVIM_CONFIG_DISPATCH_TOKEN is missing. Configure it and rerun this workflow."
            exit 1
          fi
          gh api --method POST repos/777lotto/nvim-config/dispatches \
            --raw-field event_type=plugin-release \
            --field 'client_payload[plugin]=git-panel.nvim' \
            --field "client_payload[commit]=$PLUGIN_COMMIT" \
            --field "client_payload[tag]=$PLUGIN_TAG"