viktoruj_obsidian-cloud-kms/.github/workflows/ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Minimal top-level permissions
permissions: read-all

jobs:
  check:
    runs-on: ubuntu-latest
    if: "!contains(github.event.head_commit.message, '[skip ci]')"
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install + Typecheck + Lint + Test + Audit + Build
        run: make ci

      - name: Security scan (npm audit)
        run: make audit

      - name: Upload build artifacts
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: plugin-artifacts
          path: |
            main.js
            manifest.json            

  release:
    runs-on: ubuntu-latest
    needs: check
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    permissions:
      contents: write
      id-token: write
      attestations: write

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: '20'
          cache: 'npm'

      - name: Bump patch version
        id: bump
        run: |
          CURRENT=$(jq -r .version manifest.json)
          echo "Current version: $CURRENT"
          IFS='.' read -r MAJOR MINOR PATCH <<< "$CURRENT"
          NEW_PATCH=$((PATCH + 1))
          NEW_VERSION="${MAJOR}.${MINOR}.${NEW_PATCH}"
          echo "New version: $NEW_VERSION"
          jq --arg v "$NEW_VERSION" '.version = $v' manifest.json > manifest.tmp && mv manifest.tmp manifest.json
          jq --arg v "$NEW_VERSION" '.version = $v' package.json > package.tmp && mv package.tmp package.json
          jq --arg v "$NEW_VERSION" '.version = $v | .packages[""].version = $v' package-lock.json > package-lock.tmp && mv package-lock.tmp package-lock.json
          echo "version=$NEW_VERSION" >> "$GITHUB_OUTPUT"          

      - name: Commit version bump
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add manifest.json package.json package-lock.json
          git commit -m "chore: bump version to v${{ steps.bump.outputs.version }} [skip ci]"
          git push          

      - name: Build release
        run: make release

      - name: Copy styles.css to dist
        run: cp styles.css dist/styles.css || true

      - name: Generate SBOM
        uses: anchore/sbom-action@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 # v0.18.0
        with:
          artifact-name: sbom.spdx.json
          format: spdx-json
          output-file: dist/sbom.spdx.json

      - name: Create/update release
        uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631 # v2.2.2
        with:
          tag_name: ${{ steps.bump.outputs.version }}
          name: ${{ steps.bump.outputs.version }}
          generate_release_notes: true
          files: |
            dist/main.js
            dist/manifest.json
            dist/styles.css
            dist/sbom.spdx.json            
          make_latest: true

      - name: Attest build provenance (SLSA)
        uses: actions/attest-build-provenance@db473fddc028af60658334401dc6fa3ffd8669fd # v2.3.0
        with:
          subject-path: 'dist/main.js'

      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Cosign sign main.js
        run: |
          cosign sign-blob dist/main.js \
            --bundle dist/main.js.bundle \
            --yes          
        env:
          COSIGN_EXPERIMENTAL: "1"

      - name: Upload signature to release
        uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631 # v2.2.2
        with:
          tag_name: ${{ steps.bump.outputs.version }}
          files: |
            dist/main.js.bundle