release.yml

name: Release

on:
  push:
    tags: ["v*"]

  # Dispatch the release workflow for an old tag.
  # Useful to backfill previous releases when adding a new publiser,
  # or to retry a publisher having fixed a bug in one.
  workflow_dispatch:
    inputs:
      tag:
        description: Source tag to release
        required: true

permissions:
  contents: read

concurrency:
  group: release-${{ inputs.tag || github.ref_name }}

jobs:
  goreleaser:
    runs-on: ubuntu-latest
    permissions:
      contents: write # upload release artifacts
      packages: write # push to ghcr.io
      id-token: write # attest artifacts, npm trusted publishing
      attestations: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.tag && format('refs/tags/{0}', inputs.tag) || '' }}
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
      - uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Generate GitHub App token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ vars.FLAGSMITH_ENGINEERING_GH_APP_ID }}
          private-key: ${{ secrets.FLAGSMITH_ENGINEERING_GH_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: homebrew-tap
          # Only what the cask needs: push its branch, open the pull request.
          permission-contents: write
          permission-pull-requests: write
      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
        with:
          version: "~> v2"
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
      # Attests every file listed in the checksum file.
      - uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
        with:
          subject-checksums: ./dist/checksums.txt
      - uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
        with:
          subject-checksums: ./dist/digests.txt

      - name: Build PyPI wheels
        run: ./packaging/pypi/build-wheels.sh
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: pypi-wheels
          path: dist/pypi/*.whl
          if-no-files-found: error

      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
        with:
          node-version: 24 # npm >= 11.5.1 required for OIDC trusted publishing
      - name: Publish npm packages
        continue-on-error: ${{ github.event_name == 'workflow_dispatch' }}
        uses: evg4b/goreleaser-npm-publisher-action@16087d5aafd974ba267f861cc3723f52ea14d6e4 # v1.6.0
        with:
          name: cli
          bin: flagsmith
          prefix: "@flagsmith"
          license: MIT
          repository: ${{ github.repository }}
          description: The Flagsmith command-line interface
          keywords: |-
            flagsmith
            feature-flags
            cli
          files: |-
            README.md
            LICENSE

  pypi:
    name: Publish to PyPI
    needs: goreleaser
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write # PyPI trusted publishing + PEP 740 attestations
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: pypi-wheels
          path: dist
      - uses: pypa/gh-action-pypi-publish@a892a5a61159132606e93a2fa6f4358831b04d26 # v1.14.2
        with:
          packages-dir: dist

  install-script-e2e:
    name: install.sh (${{ matrix.os }})
    needs: goreleaser
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        # When release is dispatched, test both pinned and latest installers.
        # For a normal (tag-pushed) release, test only latest installer.
        ref: ${{ fromJSON(inputs.tag && format('["", "refs/tags/{0}"]', inputs.tag) || '[""]') }}
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ matrix.ref }}
          persist-credentials: false
      - name: Install latest (Linux)
        if: ${{ !inputs.tag && runner.os != 'Windows' }}
        run: sh install.sh
      - name: Install dispatched (Linux)
        if: ${{ inputs.tag && runner.os != 'Windows' }}
        run: sh install.sh --version "${{ inputs.tag }}"
      - name: Install latest (Windows)
        if: ${{ !inputs.tag && runner.os == 'Windows' }}
        run: ./install.ps1
        shell: pwsh
      - name: Install dispatched (Windows)
        if: ${{ inputs.tag && runner.os == 'Windows' }}
        run: ./install.ps1 -Version "${{ inputs.tag }}"
        shell: pwsh
      - run: flagsmith --version