jellyfinsso/.gitea/workflows/release.yml

name: Release Plugin

on:
  push:
    tags:
      - 'v*'

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout tag
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '9.0.x'

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.x'

      - name: Install packaging dependencies
        run: python -m pip install --quiet --upgrade pyyaml

      - name: Read version and changelog from tag
        id: meta
        run: |
          set -euo pipefail
          echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

          # checkout leaves behind a lightweight ref pointing at the commit, and
          # %(contents) on one of those yields the commit message. Re-fetch the
          # real object so an annotated tag's message is what we read.
          git fetch --force origin \
            "refs/tags/${GITHUB_REF_NAME}:refs/tags/${GITHUB_REF_NAME}" || true

          CHANGELOG=""
          if [ "$(git cat-file -t "refs/tags/${GITHUB_REF_NAME}" 2>/dev/null || true)" = "tag" ]; then
            # subject+body rather than %(contents) so a signature is left out.
            CHANGELOG="$(git for-each-ref \
              --format='%(contents:subject)%0a%0a%(contents:body)' \
              "refs/tags/${GITHUB_REF_NAME}")"
          fi

          # Lightweight tag, or an annotated tag with an empty message.
          if [ -z "$(printf '%s' "$CHANGELOG" | tr -d '[:space:]')" ]; then
            echo "no annotated tag message; falling back to build.yaml"
            CHANGELOG="$(python -c "import yaml; print(yaml.safe_load(open('build.yaml')).get('changelog','').strip())")"
          fi

          {
            echo "changelog<<CHANGELOG_EOF"
            printf '%s\n' "$CHANGELOG"
            echo "CHANGELOG_EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Build and package plugin
        id: package
        env:
          VERSION: ${{ steps.meta.outputs.version }}
          CHANGELOG: ${{ steps.meta.outputs.changelog }}
        run: |
          set -euo pipefail
          python scripts/build_plugin.py \
            --version "$VERSION" \
            --changelog "$CHANGELOG" \
            --output "$RUNNER_TEMP/dist"

      - name: Switch to main
        run: |
          set -euo pipefail
          git checkout -- .
          git fetch origin main
          git checkout -B main origin/main

      - name: Update dist, build.yaml and manifest.json
        env:
          VERSION: ${{ steps.package.outputs.version }}
          ZIP_NAME: ${{ steps.package.outputs.zip_name }}
          CHECKSUM: ${{ steps.package.outputs.checksum }}
          CHANGELOG: ${{ steps.meta.outputs.changelog }}
        run: |
          set -euo pipefail
          mkdir -p dist
          cp "$RUNNER_TEMP/dist/$ZIP_NAME" "dist/$ZIP_NAME"

          python scripts/build_plugin.py --version "$VERSION" --sync-only

          python scripts/update_manifest.py \
            --version "$VERSION" \
            --checksum "$CHECKSUM" \
            --changelog "$CHANGELOG" \
            --source-url "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/raw/branch/main/dist/${ZIP_NAME}"

      - name: Commit and push to main
        env:
          # Gitea injects GITHUB_TOKEN; set RELEASE_TOKEN if that token does not
          # have write access to the repository.
          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
          DEFAULT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          TOKEN="${RELEASE_TOKEN:-$DEFAULT_TOKEN}"
          if [ -z "$TOKEN" ]; then
            echo "no token available to push manifest.json" >&2
            exit 1
          fi

          git config user.name "gitea-actions"
          git config user.email "actions@git.linxweiler.xyz"
          git add dist manifest.json build.yaml Jellyfin.Plugin.OidcAuth/Jellyfin.Plugin.OidcAuth.csproj

          if git diff --cached --quiet; then
            echo "nothing to commit"
            exit 0
          fi

          git commit -m "release: ${GITHUB_REF_NAME}"

          git remote set-url origin \
            "https://x-access-token:${TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git"
          git push origin main

      - name: Attach zip to Gitea release
        uses: akkuman/gitea-release-action@v1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          files: dist/${{ steps.package.outputs.zip_name }}
          body: ${{ steps.meta.outputs.changelog }}