release_create.yml

name: Release / Create
run-name: Release ${{ inputs.version || github.ref_name }}${{ inputs.skip_checks && ' (checks skipped)' || '' }}

on:
  push:
    tags:
      - '[0-9]+.[0-9]+.[0-9]+'
  workflow_dispatch:
    inputs:
      version:
        description: Stable version to release, without a v prefix
        required: true
        type: string
      release-theme:
        description: Optional title theme, without the version number
        default: ''
        type: string
      skip_checks:
        description: Skip pre-release tests for this release
        default: false
        type: boolean
      skip_checks_reason:
        description: Reason for skipping checks (required when skip_checks is true)
        default: ''
        type: string

permissions:
  contents: read

concurrency:
  group: release-${{ inputs.version || github.ref_name }}
  cancel-in-progress: false

jobs:
  prepare:
    name: Validate release request
    if: ${{ github.event_name != 'push' || !github.event.deleted }}
    runs-on: ubuntu-latest
    outputs:
      sha: ${{ steps.prepare.outputs.sha }}
      version: ${{ steps.prepare.outputs.version }}
    steps:
      - uses: actions/checkout@v4
        id: checkout
        with:
          ref: ${{ github.sha }}
          persist-credentials: false
      - name: Validate release configuration and pin the commit
        id: prepare
        uses: actions/github-script@v7
        env:
          VERSION: ${{ inputs.version || github.ref_name }}
          RELEASE_THEME: ${{ inputs['release-theme'] }}
          CHECKOUT_SHA: ${{ steps.checkout.outputs.commit }}
          SKIP_CHECKS: ${{ inputs.skip_checks }}
          SKIP_CHECKS_REASON: ${{ inputs.skip_checks_reason }}
          HAS_SIGNING_CERTIFICATE: ${{ secrets.SIGNING_CERTIFICATE_BASE_64 != '' }}
          HAS_SIGNING_PASSWORD: ${{ secrets.SIGNING_CERTIFICATE_PASSWORD != '' }}
          HAS_BINARY_REPO_TOKEN: ${{ secrets.BINARY_REPO_PAT != '' }}
        with:
          script: |
            const { validateVersion, validateSHA, validateReleaseRef, getTagSHA } = require('./Scripts/CI/release.js');
            const { validateTheme } = require('./Scripts/CI/release-notes.js');
            if (process.env.RELEASE_THEME) validateTheme(process.env.RELEASE_THEME);
            if (['HAS_SIGNING_CERTIFICATE', 'HAS_SIGNING_PASSWORD', 'HAS_BINARY_REPO_TOKEN'].some(name => process.env[name] !== 'true')) {
              throw new Error('Signing and binary repository credentials must be configured.');
            }
            const version = validateVersion(process.env.VERSION);
            const isTagPush = context.eventName === 'push';
            if (isTagPush) {
              if (context.ref !== `refs/tags/${version}`) throw new Error('Push must refer to the requested version tag.');
            } else {
              validateReleaseRef(version, context.ref);
            }
            const sha = validateSHA(process.env.CHECKOUT_SHA);
            if (!isTagPush && sha !== context.sha) throw new Error('The checked-out commit must match the dispatch commit.');
            const skipChecks = process.env.SKIP_CHECKS === 'true';
            const skipReason = (process.env.SKIP_CHECKS_REASON || '').trim();
            if (skipChecks && !skipReason) throw new Error('A reason is required when skipping pre-release checks.');
            const existing = await getTagSHA(github, context.repo, version);
            if (isTagPush && !existing) throw new Error(`Tag ${version} no longer exists.`);
            if (existing && existing !== sha) throw new Error(`Tag ${version} already points to ${existing}.`);
            core.setOutput('version', version);
            core.setOutput('sha', sha);
            await core.summary.addHeading('Release candidate').addTable([
              ['Version', version], ['Commit', sha],
              ['Pre-release checks', skipChecks ? 'Skipped by request' : 'Required'],
            ]).write();
            if (skipChecks) {
              core.warning('Pre-release checks were explicitly skipped for this release.');
              await core.summary.addHeading('Pre-release checks skipped')
                .addTable([['Requested by', context.actor]])
                .addCodeBlock(skipReason, 'text').write();
            }
      - name: Verify source version
        uses: actions/github-script@v7
        env:
          VERSION: ${{ steps.prepare.outputs.version }}
        with:
          script: |
            const { validateSourceVersion } = require('./Scripts/CI/release.js');
            await validateSourceVersion(process.env.VERSION);

  checks:
    if: ${{ !inputs.skip_checks }}
    needs: prepare
    uses: ./.github/workflows/release_checks.yml
    permissions:
      contents: read
      issues: read
      pull-requests: read
      statuses: write
      id-token: write
    with:
      ref: ${{ needs.prepare.outputs.sha }}
    secrets:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  build:
    needs: [prepare, checks]
    if: >-
      !cancelled() && needs.prepare.result == 'success' &&
      ((inputs.skip_checks && needs.checks.result == 'skipped') ||
       (!inputs.skip_checks && needs.checks.result == 'success'))
    uses: ./.github/workflows/release_build.yml
    permissions:
      contents: read
      id-token: write
    with:
      ref: ${{ needs.prepare.outputs.sha }}
      version: ${{ needs.prepare.outputs.version }}
    secrets:
      SIGNING_CERTIFICATE_BASE_64: ${{ secrets.SIGNING_CERTIFICATE_BASE_64 }}
      SIGNING_CERTIFICATE_PASSWORD: ${{ secrets.SIGNING_CERTIFICATE_PASSWORD }}

  tag:
    name: Create or verify the release tag
    permissions:
      contents: write
    needs: [prepare, checks, build]
    if: >-
      !cancelled() && needs.prepare.result == 'success' && needs.build.result == 'success' &&
      ((inputs.skip_checks && needs.checks.result == 'skipped') ||
       (!inputs.skip_checks && needs.checks.result == 'success'))
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.prepare.outputs.sha }}
          persist-credentials: false
      - name: Validate tag prerequisites
        uses: actions/github-script@v7
        env:
          SKIP_CHECKS: ${{ inputs.skip_checks }}
          CANDIDATE_SHA: ${{ needs.prepare.outputs.sha }}
          VERIFIED_SHA: ${{ needs.checks.outputs.verified-sha }}
          BUILT_SHA: ${{ needs.build.outputs.sha }}
          ARTIFACT_ID: ${{ needs.build.outputs.artifact-id }}
        with:
          script: |
            const { validateSHA } = require('./Scripts/CI/release.js');
            const sha = validateSHA(process.env.CANDIDATE_SHA);
            if (process.env.SKIP_CHECKS !== 'true' && process.env.VERIFIED_SHA !== sha) {
              throw new Error('Checks must refer to the candidate commit.');
            }
            if (process.env.BUILT_SHA !== sha || !process.env.ARTIFACT_ID) {
              throw new Error('Stored release artifacts must refer to the candidate commit.');
            }
      - name: Create or verify version tag
        uses: actions/github-script@v7
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
          CANDIDATE_SHA: ${{ needs.prepare.outputs.sha }}
        with:
          github-token: ${{ github.token }}
          script: |
            const { ensureTag, getTagSHA } = require('./Scripts/CI/release.js');
            const version = process.env.VERSION;
            const sha = process.env.CANDIDATE_SHA;
            if (context.eventName === 'push') {
              if (await getTagSHA(github, context.repo, version) !== sha) {
                throw new Error('The release tag must still point to the candidate commit.');
              }
            } else {
              await ensureTag({ github, repo: context.repo, version, sha });
            }

  publish:
    needs: [prepare, build, tag]
    if: >-
      !cancelled() && needs.prepare.result == 'success' &&
      needs.build.result == 'success' && needs.tag.result == 'success'
    uses: ./.github/workflows/release_publish.yml
    permissions:
      contents: write
    with:
      ref: ${{ needs.prepare.outputs.sha }}
      version: ${{ needs.prepare.outputs.version }}
      artifact-id: ${{ needs.build.outputs.artifact-id }}
      release-theme: ${{ inputs['release-theme'] || '' }}
    secrets:
      BINARY_REPO_PAT: ${{ secrets.BINARY_REPO_PAT }}
      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
      INTERFACE_COVERAGE_PAT: ${{ secrets.INTERFACE_COVERAGE_PAT }}

  documentation:
    needs: publish
    if: ${{ !cancelled() && needs.publish.result == 'success' }}
    uses: ./.github/workflows/documentation.yml
    permissions:
      contents: read
      packages: write
      pages: write
      id-token: write