release.yml

name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

# One release per tag at a time: a re-run or duplicate push must not race the
# draft -> upload -> publish sequence below.
concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  release:
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      # Python 3.10 is used by the build/version steps below (build_zip.py, addon.xml).
      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: "3.10"

      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
        with:
          python-version: "3.14"

      - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0

      # Same pinned, reproducible suite as CI (excludes the extensive markers).
      - name: Run tests
        env:
          UV_PYTHON: "3.14"
        run: just test

      - name: Extract version from tag
        id: version
        run: echo "version=${GITHUB_REF#refs/tags/v}" >> "$GITHUB_OUTPUT"

      - name: Verify addon.xml version matches tag
        run: |
          xml_version=$(python3 -c "
          import xml.etree.ElementTree as ET
          tree = ET.parse('repo/plugin.video.nzbdav/addon.xml')
          print(tree.getroot().get('version'))
          ")
          if [ "$xml_version" != "${{ steps.version.outputs.version }}" ]; then
            echo "ERROR: addon.xml version ($xml_version) does not match tag (${{ steps.version.outputs.version }})"
            exit 1
          fi

      # The release body is the curated CHANGELOG.md section for this version.
      # A missing or empty section fails here, before any release exists.
      - name: Extract release notes from CHANGELOG.md
        env:
          RELEASE_VERSION: ${{ steps.version.outputs.version }}
        run: python3 scripts/release_notes.py "$RELEASE_VERSION" > release-notes.md

      - name: Build addon zip
        run: python3 scripts/build_zip.py

      # Created as a draft first: GitHub's immutable-releases policy makes a
      # release read-only for new asset uploads the instant it's published, but
      # softprops/action-gh-release creates-then-uploads as two separate calls.
      # Publishing directly races that window and can leave a permanently
      # asset-less release behind (worse: the tag name is then permanently
      # unusable for any future release, published or not). Drafts stay
      # mutable regardless of that policy, so the asset upload always lands
      # before the "Publish release" step below flips it to published.
      - name: Create GitHub Release (draft)
        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v2
        with:
          files: plugin.video.nzbdav-${{ steps.version.outputs.version }}.zip
          # Curated CHANGELOG section first; GitHub appends the categorized
          # PR list (.github/release.yml) after it.
          body_path: release-notes.md
          generate_release_notes: true
          draft: true
          # Semver prerelease tags (e.g. v1.2.6-beta.1) carry a hyphen after the
          # version. Flag those as pre-release so the Appz4Fun Kodi repository,
          # which splits Stable vs Beta by the GitHub pre-release checkbox, routes
          # beta builds to the Beta channel instead of publishing them to Stable.
          prerelease: ${{ contains(github.ref_name, '-') }}

      - name: Publish release
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ github.ref_name }}
          RELEASE_REPO: ${{ github.repository }}
        run: gh release edit "$RELEASE_TAG" --draft=false --repo "$RELEASE_REPO"

      # Ping the Appz4Fun Kodi repository so it rebuilds within seconds instead
      # of waiting for its daily schedule. Needs a fine-grained PAT with
      # Contents: read+write on Appz4Fun/Appz4Fun-Kodi-Repo, stored here as the
      # secret REPO_DISPATCH_TOKEN. Best-effort: never fails the release.
      - name: Notify Appz4Fun Kodi repository
        continue-on-error: true
        env:
          DISPATCH_TOKEN: ${{ secrets.REPO_DISPATCH_TOKEN }}
        run: |
          if [ -z "$DISPATCH_TOKEN" ]; then
            echo "REPO_DISPATCH_TOKEN not set; skipping (Kodi repo still rebuilds on its daily schedule)."
            exit 0
          fi
          curl -sS -f -X POST \
            -H "Authorization: Bearer $DISPATCH_TOKEN" \
            -H "Accept: application/vnd.github+json" \
            https://api.github.com/repos/Appz4Fun/Appz4Fun-Kodi-Repo/dispatches \
            -d '{"event_type":"addon-released"}' \
            && echo "Triggered Appz4Fun-Kodi-Repo rebuild." \
            && echo "A disabled Build & Deploy workflow there ignores this dispatch;" \
            && echo "confirm a run with: gh run list --repo Appz4Fun/Appz4Fun-Kodi-Repo --event repository_dispatch"