.github/workflows/draft-release.yml

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

name: Draft Release

on:
  push:
    tags:
      - 'draft/**'

permissions:
  contents: read
  id-token: write

jobs:
  upload-to-atr:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 1

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          package-manager-cache: false
          cache: ''

      - name: Setup environment variables
        run: |
          REPO_NAME="${GITHUB_REPOSITORY#*/}"
          TAG_NAME="${GITHUB_REF#refs/tags/}"
          TARGET_RELEASE_VERSION="${TAG_NAME#draft/}"
          SRC_PACKAGE_NAME=${REPO_NAME}-source-${TARGET_RELEASE_VERSION}
          SRC_PACKAGE_TAR=${SRC_PACKAGE_NAME}.tar
          SRC_PACKAGE_TAR_GZ=${SRC_PACKAGE_NAME}.tar.gz
          SRC_PACKAGE_ZIP=${SRC_PACKAGE_NAME}.zip
          NPM_PACKAGE_NAME=${REPO_NAME}-npm-${TARGET_RELEASE_VERSION}

          echo "REPO_NAME=$REPO_NAME" >> $GITHUB_ENV
          echo "TAG_NAME=$TAG_NAME" >> $GITHUB_ENV
          echo "TARGET_RELEASE_VERSION=$TARGET_RELEASE_VERSION" >> $GITHUB_ENV
          echo "SRC_PACKAGE_NAME=$SRC_PACKAGE_NAME" >> $GITHUB_ENV
          echo "SRC_PACKAGE_TAR=$SRC_PACKAGE_TAR" >> $GITHUB_ENV
          echo "SRC_PACKAGE_TAR_GZ=$SRC_PACKAGE_TAR_GZ" >> $GITHUB_ENV
          echo "SRC_PACKAGE_ZIP=$SRC_PACKAGE_ZIP" >> $GITHUB_ENV
          echo "NPM_PACKAGE_NAME=$NPM_PACKAGE_NAME" >> $GITHUB_ENV

          echo "REPO_NAME=$REPO_NAME"
          echo "TAG_NAME=$TAG_NAME"
          echo "TARGET_RELEASE_VERSION=$TARGET_RELEASE_VERSION"
          echo "SRC_PACKAGE_NAME=$SRC_PACKAGE_NAME"
          echo "SRC_PACKAGE_TAR=$SRC_PACKAGE_TAR"
          echo "SRC_PACKAGE_TAR_GZ=$SRC_PACKAGE_TAR_GZ"
          echo "SRC_PACKAGE_ZIP=$SRC_PACKAGE_ZIP"
          echo "NPM_PACKAGE_NAME=$NPM_PACKAGE_NAME"

      - name: Verify Target Release Version
        run: |
          PACKAGE_VERSION=$(jq -r '.version' package.json)
          if [ "$PACKAGE_VERSION" != "$TARGET_RELEASE_VERSION" ]; then
            echo "Mismatch version detected between tag version ($TARGET_RELEASE_VERSION) and package version ($PACKAGE_VERSION)"
            exit 1
          fi

          if [ -f "plugin.xml" ]; then
            PLUGIN_VERSION=$(yq -p=xml -o=json '.plugin.+@version' plugin.xml | jq -r .)
            if [ "$PLUGIN_VERSION" != "$TARGET_RELEASE_VERSION" ]; then
              echo "Mismatch version detected between tag version ($TARGET_RELEASE_VERSION) and plugin version ($PLUGIN_VERSION)"
              exit 1
            fi
          fi

      - name: Generate "tgz" npm convenience package
        run: |-
          npm ci
          NPM_PKG_NAME=$(npm pack --json | jq -r '.[0].filename')
          mv ./.asf-release/$NPM_PKG_NAME ./.asf-release/${NPM_PACKAGE_NAME}.tgz
        env:
          TZ: UTC

      - name: Generate "tar" source package
        run: |-
          export SRC_LAST_COMMIT_EPOCH=$(git log -1 --format=%ct "$TAG_NAME")

          git archive \
            --prefix=$SRC_PACKAGE_NAME/ \
            --mtime=$SRC_LAST_COMMIT_EPOCH \
            -o ./.asf-release/${SRC_PACKAGE_TAR} \
            $TAG_NAME
        env:
          TZ: UTC

      - name: Generate "tar.gz" source archive
        working-directory: ./.asf-release
        run: |-
          gzip -n -9 -c "$SRC_PACKAGE_TAR" > "$SRC_PACKAGE_TAR_GZ"
        env:
          TZ: UTC

      - name: Generate "zip" source archive
        working-directory: ./.asf-release
        run: |-
          export ASF_RELEASE_DIR=$(pwd)
          export TMP_DIR=$(mktemp -d)

          tar -xf "$SRC_PACKAGE_TAR" -C "$TMP_DIR"
          (
            cd "$TMP_DIR"
            find . -type f | LC_ALL=C sort | zip -X -q "$ASF_RELEASE_DIR/$SRC_PACKAGE_ZIP" -@
          )
          rm -rf $TMP_DIR
        env:
          TZ: UTC

      - name: Cleanup Process
        working-directory: ./.asf-release
        run: |-
          rm -rf $SRC_PACKAGE_TAR
          rm -rf .gitkeep

      - name: Create Sign and Checksum
        working-directory: .asf-release
        run: |-
          for f in *.tar.gz *.tgz *.zip; do
            [ -e "$f" ] || continue
            echo "$CORDOVA_GPG_SECRET_KEY" | gpg --batch --import --import-options import-show
            gpg --armor --detach-sign "$f"
            sha512sum "$f" > "${f}.sha512"
          done
        env:
          CORDOVA_GPG_SECRET_KEY: ${{ secrets.CORDOVA_GPG_SECRET_KEY }}

      - name: Upload to Apache Trusted Release (ATR)
        uses: apache/tooling-actions/upload-to-atr@f5f4c0e7ddfbde6b1f8288cef36324c6def68051
        with:
          project: ${{ env.REPO_NAME }}
          version: ${{ env.TARGET_RELEASE_VERSION }}
          src: .asf-release