release.yml

name: Release
# Manual only. The daily schedule and the openapi-updated repository_dispatch
# triggers were removed so a spec change never auto-publishes to wp.org without
# review. Run a release deliberately with:
#   gh workflow run release.yml -f version_bump=patch|minor|major
on:
    workflow_dispatch:
        inputs:
            version_bump:
                description: 'patch | minor | major'
                required: false
                default: 'patch'

jobs:
    release:
        runs-on: ubuntu-latest
        permissions:
            contents: write
        steps:
            - uses: actions/checkout@v7
              with:
                  token: ${{ secrets.GITHUB_TOKEN }}
                  fetch-depth: 0

            - uses: shivammathur/setup-php@v2
              with:
                  php-version: '8.3'
                  extensions: mysqli, zip, gd
                  tools: composer
                  coverage: none
            # Install dev deps for verification (PHPUnit, PHPStan, PHPCS).
            # Re-installed without --dev right before deploy.
            - run: composer install --prefer-dist

            - uses: actions/setup-node@v7
              with:
                  node-version: '24'
                  cache: 'npm'
            - run: npm ci

            - name: Regenerate from live OpenAPI
              run: npm run generate

            # The translation template is a build artifact, regenerated every release so it
            # always describes the code being shipped. wp.org extracts its own copy from the
            # source; this one serves translators working from the GitHub zip.
            - name: Refresh the translation template
              run: |
                  curl -sSL -o /tmp/wp-cli.phar https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
                  php /tmp/wp-cli.phar i18n make-pot . languages/roxyapi.pot --slug=roxyapi --skip-audit --exclude=build --allow-root

            - name: Lint
              run: vendor/bin/phpcs --standard=phpcs.xml.dist

            - name: Static analysis
              run: vendor/bin/phpstan analyze --no-progress --memory-limit=1G

            - name: Build blocks
              run: npm run build:all

            # The drift guards CI runs. A green CI only proves the commit was
            # sound BEFORE this job regenerated from the live spec and rebuilt
            # the blocks, so without these a release cut from a clean main can
            # still ship a nested block layout that registers nothing, a
            # component map pointing at components the pinned UI build lacks, or
            # a zip whose contents differ from what the SVN deploy sends.
            - name: Block layout is flat so the whole catalog registers
              run: npm run check:blocks
            - name: Every mapped component exists in the pinned UI build
              run: npm run check:component-map
            - name: Local zip and SVN deploy ship the same files
              run: npm run check:distignore
            # The geocode check renders the real stylesheet in a browser. With
            # no browser binary it silently drops to source checks only, so
            # chromium has to be installed or the gate proves nothing.
            - name: Install chromium for the rendered CSS check
              run: npx playwright install --with-deps chromium
            - name: City search dropdown survives a hostile theme
              run: npm run check:geocode

            - name: PHPUnit
              env:
                  DB_HOST: 127.0.0.1
              run: |
                  sudo apt-get install -y -qq subversion
                  sudo systemctl start mysql
                  mysql -uroot -proot -e "CREATE DATABASE IF NOT EXISTS wordpress_test;"
                  bash bin/install-wp-tests.sh wordpress_test root root 127.0.0.1 latest true
                  vendor/bin/phpunit

            # Plugin Check against the built zip, installed under the wp.org
            # slug. The distignore guard above is what makes this the shipped
            # artifact and not a lookalike: it fails the release unless the
            # locally built zip and the SVN deploy carry the same files.
            #
            # CI can only ever check the mounted repo folder, which is named for
            # the repo and not the plugin: every __() call then reports a text
            # domain mismatch and files the zip never contains get scanned,
            # which is why CI has to keep it advisory. Installing the zip makes
            # the slug `roxyapi`, so this is the review wp.org will actually run.
            #
            # `wp plugin check` exits 0 whatever it finds, so the ERROR count is
            # the gate. Warnings are printed and do not block, which keeps a
            # long-standing advisory notice from holding up every release.
            #
            # `wp-env run` can answer "Environment not initialized" on a GitHub
            # runner straight after a successful `start`. Retrying `start` plus a
            # `wp cli info` probe until it responds is what WordPress's own
            # plugin-check-action does, and it is what lets this be a hard gate
            # rather than another advisory step.
            - name: Plugin Check the release zip
              env:
                  NODE_OPTIONS: --dns-result-order=ipv4first --no-network-family-autoselection
              run: |
                  npm run plugin-zip
                  for attempt in 1 2 3; do
                    if npx wp-env start --update && npx wp-env run cli wp cli info; then
                      break
                    fi
                    echo "wp-env not ready (attempt $attempt of 3), retrying"
                    sleep 15
                  done
                  npx wp-env run cli wp plugin install \
                    "/var/www/html/wp-content/plugins/$(basename "$PWD")/roxyapi.zip" --force
                  npx wp-env run cli wp plugin check roxyapi --severity=5 --format=json \
                    > "$RUNNER_TEMP/plugin-check.json"
                  cat "$RUNNER_TEMP/plugin-check.json"
                  if grep -q '"type":"ERROR"' "$RUNNER_TEMP/plugin-check.json"; then
                    echo "::error::Plugin Check found errors in roxyapi.zip. WordPress.org would reject this release."
                    exit 1
                  fi

            - name: Reinstall composer without dev deps for shipped vendor/
              run: composer install --no-dev --optimize-autoloader --prefer-dist

            - name: Bump version
              id: bump
              run: |
                  BUMP="${{ github.event.inputs.version_bump || 'patch' }}"
                  npm version "$BUMP" --no-git-tag-version
                  VERSION=$(node -p "require('./package.json').version")
                  # readme.txt notes are HAND-authored: this job only rewrites Stable tag.
                  # Without this gate a release ships with the previous version as its
                  # newest note, and a site owner has no way to see what changed.
                  ENTRIES=$(grep -c "^= $VERSION =\$" readme.txt || true)
                  if [ "$ENTRIES" -lt 2 ]; then
                    echo "::error::readme.txt needs a '= $VERSION =' entry under BOTH == Changelog == and == Upgrade Notice == (found $ENTRIES of 2). They are hand-written; add them, then re-run."
                    exit 1
                  fi
                  echo "version=$VERSION" >> $GITHUB_OUTPUT
                  sed -i "s/^\(\s*\*\s*Version:\s*\).*/\1$VERSION/" roxyapi.php
                  sed -i "s/const ROXYAPI_VERSION\s*=\s*'[^']*';/const ROXYAPI_VERSION     = '$VERSION';/" roxyapi.php
                  sed -i "s/^Stable tag:.*$/Stable tag: $VERSION/" readme.txt

            - name: Commit, tag, push
              run: |
                  git config user.name "github-actions[bot]"
                  git config user.email "github-actions[bot]@users.noreply.github.com"
                  VERSION="${{ steps.bump.outputs.version }}"
                  git add .
                  git commit -m "release: v$VERSION"
                  git tag "v$VERSION"
                  git push --follow-tags

            - name: Deploy to WordPress.org
              id: deploy
              uses: 10up/action-wordpress-plugin-deploy@stable
              with:
                  generate-zip: true
              env:
                  SVN_USERNAME: ${{ secrets.SVN_USERNAME }}
                  SVN_PASSWORD: ${{ secrets.SVN_PASSWORD }}
                  SLUG: roxyapi
                  VERSION: ${{ steps.bump.outputs.version }}

            - name: Attach zip to GitHub release
              uses: softprops/action-gh-release@v3
              with:
                  tag_name: v${{ steps.bump.outputs.version }}
                  files: ${{ steps.deploy.outputs.zip-path }}
                  generate_release_notes: true