lossless-group_image-gin/.github/workflows/release.yml
mpstaton d3d7a6a626 chore(release): 0.2.3 — workflow-driven releases + artifact attestations + log.json gitignored
Three things bundled:

1. Release workflow at .github/workflows/release.yml fires on every 3-digit-semver tag push. Builds main.js + styles.css in a clean Ubuntu runner, signs all three release assets via actions/attest-build-provenance@v1 (sigstore-backed via OIDC), creates the GitHub Release with notes pulled from release-notes/<tag>.md. Identical to the workflow landing across cite-wide, perplexed, metafetch as a family-wide pattern.

2. release-notes/0.2.3.md authored in marketing-shape per content-farm/context-v/skills/changelog-conventions/SKILL.md "These are marketing artifacts" section. Convention going forward: every release's body lives in the repo at this path before the tag is pushed.

3. log.json now in .gitignore — runtime plugin telemetry that captures at first-run per-vault, never source-of-truth. Was tracked accidentally in earlier commits; this stops the dirty-tree noise on every git status.

Version bumped 0.2.2 → 0.2.3 across manifest.json / package.json / versions.json. No source-code changes — Drop Gate, Recraft generation, Ideogram v3, Magnific search, ImageKit upload all behave identically to 0.2.2.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-18 03:09:02 -05:00

88 lines
2.9 KiB
YAML

name: Release plugin
# Fires when a 3-digit-semver tag is pushed (e.g. 0.1.6). Builds the plugin
# in a clean Ubuntu runner, signs the produced main.js / manifest.json /
# styles.css with GitHub's artifact-attestation (sigstore-backed), and
# creates the GitHub Release with those three files attached. Anyone
# installing can verify provenance with `gh attestation verify <file>
# --repo lossless-group/metafetch`.
#
# Release notes: if release-notes/<tag>.md exists in the repo at the tagged
# commit, it's used verbatim as the release body. Otherwise the workflow
# falls back to GitHub's --generate-notes. The convention going forward is
# to author the marketing-shape notes in release-notes/<version>.md before
# tagging (per content-farm/context-v/skills/changelog-conventions/SKILL.md
# "These are marketing artifacts" section — every release page is a
# four-audience marketing surface, not a commit-message recap).
on:
push:
tags:
- '[0-9]+.[0-9]+.[0-9]+'
permissions:
contents: write # gh release create / asset upload
id-token: write # OIDC token for sigstore signing
attestations: write # write the attestation to GitHub's attestation API
jobs:
release:
runs-on: ubuntu-latest
steps:
- name: Check out tagged commit
uses: actions/checkout@v4
- name: Install pnpm
uses: pnpm/action-setup@v4
with:
version: 10
run_install: false
- name: Set up Node
uses: actions/setup-node@v4
with:
node-version: 22
cache: pnpm
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Build plugin
run: pnpm build
- name: Attest build provenance
uses: actions/attest-build-provenance@v1
with:
subject-path: |
main.js
manifest.json
styles.css
- name: Pick release-notes source
id: notes
run: |
NOTES_FILE="release-notes/${GITHUB_REF_NAME}.md"
if [ -f "$NOTES_FILE" ]; then
echo "found=true" >> "$GITHUB_OUTPUT"
echo "path=$NOTES_FILE" >> "$GITHUB_OUTPUT"
echo "Using release-notes/${GITHUB_REF_NAME}.md as release body"
else
echo "found=false" >> "$GITHUB_OUTPUT"
echo "No release-notes/${GITHUB_REF_NAME}.md found — falling back to --generate-notes"
fi
- name: Create release
env:
GH_TOKEN: ${{ github.token }}
run: |
if [ "${{ steps.notes.outputs.found }}" = "true" ]; then
gh release create "$GITHUB_REF_NAME" \
--title "$GITHUB_REF_NAME" \
--notes-file "${{ steps.notes.outputs.path }}" \
main.js manifest.json styles.css
else
gh release create "$GITHUB_REF_NAME" \
--title "$GITHUB_REF_NAME" \
--generate-notes \
main.js manifest.json styles.css
fi