release.yml

name: Release

on:
  push:
    branches:
      - main

jobs:
  release:
    runs-on: ubuntu-latest
    # Guard 1 — explicit commit-message filter.
    # The release plugin always prefixes its own commits with "[Gradle Release Plugin]".
    # Skipping those prevents a loop even if the checkout token is ever changed to a PAT.
    # Guard 2 (implicit) — GitHub does not re-trigger workflows for pushes made with
    # GITHUB_TOKEN, so this condition is a belt-and-suspenders safety net.
    if: "!startsWith(github.event.head_commit.message, '[Gradle Release Plugin]')"

    permissions:
      contents: write   # push version-bump commits and tag

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          lfs: true
          # Using GITHUB_TOKEN means the release plugin's push-back commits
          # are attributed to github-actions[bot] and will NOT re-trigger this workflow.
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 17

      - name: Read Gradle version
        id: gradle-version
        run: |
          distribution_url="$(sed -n 's/^distributionUrl=//p' gradle/wrapper/gradle-wrapper.properties)"
          gradle_version="$(printf '%s\n' "$distribution_url" | sed -E 's#.*gradle-([0-9][^-]*)-(bin|all)\.zip#\1#')"
          if [[ -z "$gradle_version" || "$gradle_version" == "$distribution_url" ]]; then
            echo "::error file=gradle/wrapper/gradle-wrapper.properties::Unable to parse Gradle version from distributionUrl='$distribution_url'."
            exit 1
          fi
          echo "version=$gradle_version" >> "$GITHUB_OUTPUT"

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v4
        with:
          gradle-version: ${{ steps.gradle-version.outputs.version }}
          validate-wrappers: false

      - name: Configure Git identity
        run: |
          git config user.name  "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Verify snapshot version
        run: |
          version="$(sed -n 's/^version=//p' gradle.properties)"
          if [[ "$version" != *-SNAPSHOT ]]; then
            echo "::error file=gradle.properties::Expected a SNAPSHOT version before release, found '$version'. A previous release may have stopped after its pre-tag commit; bump to the next SNAPSHOT version before retrying."
            exit 1
          fi

      - name: Run release
        env:
          JETBRAINS_TOKEN:      ${{ secrets.JETBRAINS_TOKEN }}
          OSSRH_USERNAME:       ${{ secrets.OSSRH_USERNAME }}
          OSSRH_PASSWORD:       ${{ secrets.OSSRH_PASSWORD }}
          SIGNING_KEY_FILE:     ${{ runner.temp }}/signing.key
          SIGNING_KEY_PASSWORD: ${{ secrets.SIGNING_KEY_PASSWORD }}
          CI: "true"
        run: |
          if [ -n "${{ secrets.SIGNING_KEY_ASC }}" ]; then
            echo "${{ secrets.SIGNING_KEY_ASC }}" > "$SIGNING_KEY_FILE"
          fi

          gradle release \
            -Prelease.useAutomaticVersion=true

      - name: Upload plugin distribution
        uses: actions/upload-artifact@v4
        with:
          name: plugin-distribution
          path: plugin-idea/build/distributions/*.zip
          if-no-files-found: warn