release.yml

name: Build and Release Plugin

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: Existing tag to package and upload to an existing release
        required: true
        type: string

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Resolve release tag
        id: release_meta
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "tag=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
          else
            echo "tag=${{ github.event.release.tag_name }}" >> "$GITHUB_OUTPUT"
          fi

      - name: Checkout code
        uses: actions/checkout@v5
        with:
          ref: ${{ steps.release_meta.outputs.tag }}

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: "8.1"

      - name: PHP Lint
        run: |
          set -e
          echo "Running php -l on all PHP files..."
          found=0
          while IFS= read -r -d '' f; do
            php -l "$f" >/dev/null || { echo "Syntax error in $f"; exit 1; }
            found=1
          done < <(find . -maxdepth 5 -name '*.php' -not -path './.git/*' -not -path './vendor/*' -print0)
          if [ "$found" -eq 0 ]; then
            echo "❌ No PHP files found (plugin must include PHP)"
            exit 1
          fi
          echo "✅ PHP lint passed"

      - name: Create production-ready plugin ZIP
        run: bash scripts/package-plugin.sh

      - name: Verify ZIP structure
        run: |
          echo "📦 ZIP Contents:"
          unzip -l rank-math-api-manager.zip | head -25

          if ! unzip -Z1 rank-math-api-manager.zip | grep -q '^rank-math-api-manager/$'; then
            echo "❌ ZIP root folder is missing or incorrectly named"
            exit 1
          fi

          if ! unzip -Z1 rank-math-api-manager.zip | grep -q '^rank-math-api-manager/rank-math-api-manager\.php$'; then
            echo "❌ Main plugin file is missing from the expected path"
            exit 1
          fi

          if ! unzip -Z1 rank-math-api-manager.zip | grep -qE '^rank-math-api-manager/assets/'; then
            echo "❌ assets/ directory is missing from the ZIP"
            exit 1
          fi

          if ! unzip -Z1 rank-math-api-manager.zip | grep -qE '^rank-math-api-manager/assets/images/'; then
            echo "❌ assets/images/ (icon assets) is missing from the ZIP"
            exit 1
          fi

          # Verify forbidden local artifacts are not present (path segments only; no false positives for names like agent-skills-helper)
          if unzip -Z1 rank-math-api-manager.zip | grep -E '(^|/)\.cursor/|(^|/)agent-skills/|\.code-workspace$|(^|/)transcripts/|(^|/)agent-transcripts/|(^|/)local-notes/|(^|/)\.notes/'; then
            echo "❌ Forbidden local artifacts detected in release ZIP"
            exit 1
          fi

          if unzip -Z1 rank-math-api-manager.zip | grep -E '(^|/)\.DS_Store$|icon-proof\.html$|icon-direction-.*\.svg$'; then
            echo "❌ Forbidden design or macOS artifacts detected in release ZIP"
            exit 1
          fi

          echo "✅ ZIP structure verified: root folder, main plugin file, and assets (including images) are correct"
          echo "✅ Packaging exclusions verified: no local agent or design-only artifacts in release ZIP"

      - name: Upload Release Asset
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.release_meta.outputs.tag }}
          files: rank-math-api-manager.zip
          overwrite_files: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Verify Release Completion
        run: |
          echo "✅ Release asset uploaded successfully"
          echo "📦 File: rank-math-api-manager.zip"
          echo "📋 Contents: Production-ready plugin files only"
          echo "🚀 Ready for WordPress auto-update system"