release.yml

name: Release

# Push a tag vX.Y.Z to release: the workflow checks the versions, builds, tests, publishes the VSIX to the
# Visual Studio Marketplace and creates the GitHub release. Run it manually for a dry run: it builds, tests and
# checks the Marketplace sign-in, without publishing.
#
# The Marketplace sign-in uses Microsoft Entra ID (GitHub OIDC, no secret to renew): environment variables
# AZURE_CLIENT_ID and AZURE_TENANT_ID of the 'marketplace' environment name an identity that is a member of the
# publisher.

on:
  push:
    tags: ['v*.*.*']
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: release
  cancel-in-progress: false

jobs:
  build:
    name: Build and test
    runs-on: windows-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - uses: actions/checkout@v7

      - uses: microsoft/setup-msbuild@v3

      - name: Check version
        id: version
        shell: pwsh
        run: |
          [xml]$manifest = Get-Content 'SourceControlSwitcher/Manifest/source.extension.vsixmanifest'
          $version = $manifest.PackageManifest.Metadata.Identity.Version
          $assembly = (Select-String -Path 'SourceControlSwitcher/Properties/AssemblyInfo.cs' -Pattern 'AssemblyVersion\("([^"]+)"\)').Matches[0].Groups[1].Value
          $registration = (Select-String -Path 'SourceControlSwitcher/SourceControlSwitcherPackage.cs' -Pattern 'InstalledProductRegistration\("#110", "#112", "([^"]+)"\)').Matches[0].Groups[1].Value
          Write-Host "Manifest: $version  AssemblyVersion: $assembly  InstalledProductRegistration: $registration"
          if ($assembly -ne "$version.0") { throw "AssemblyVersion $assembly does not match manifest version $version" }
          if ($registration -ne $version) { throw "InstalledProductRegistration $registration does not match manifest version $version" }
          if ($env:GITHUB_REF_TYPE -eq 'tag' -and $env:GITHUB_REF_NAME -ne "v$version") { throw "Tag $env:GITHUB_REF_NAME does not match manifest version v$version" }
          if (-not (Select-String -Path 'CHANGELOG.txt' -SimpleMatch "SourceControlSwitcher - v$version" -Quiet)) { throw "CHANGELOG.txt has no section for v$version" }
          "version=$version" >> $env:GITHUB_OUTPUT

      - name: Build
        run: msbuild SourceControlSwitcher.slnx -restore -p:Configuration=Release -p:DeployExtension=false -v:minimal

      - name: Test
        run: dotnet test SourceControlSwitcher.Tests/SourceControlSwitcher.Tests.csproj -c Release --no-build

      - name: Release notes from CHANGELOG
        shell: pwsh
        run: |
          $lines = Get-Content 'CHANGELOG.txt'
          $start = [Array]::FindIndex($lines, [Predicate[string]]{ param($l) $l -eq "SourceControlSwitcher - v${{ steps.version.outputs.version }}" })
          $end = [Array]::FindIndex($lines, $start + 1, [Predicate[string]]{ param($l) $l -like 'SourceControlSwitcher - v*' })
          if ($end -lt 0) { $end = $lines.Length }
          $lines[($start + 2)..($end - 1)] | Set-Content -Encoding utf8 'release-notes.md'
          Get-Content 'release-notes.md'

      - name: Upload VSIX and release notes
        uses: actions/upload-artifact@v7
        with:
          name: release
          path: |
            target/Release/SourceControlSwitcher.vsix
            release-notes.md
          if-no-files-found: error

  publish:
    name: Publish
    needs: build
    runs-on: windows-latest
    environment: marketplace
    permissions:
      contents: write
      id-token: write
    steps:
      - uses: actions/checkout@v7

      - uses: microsoft/setup-msbuild@v3

      - name: Download VSIX and release notes
        uses: actions/download-artifact@v7
        with:
          name: release
          path: release

      - name: Sign in to Microsoft Entra ID
        uses: azure/login@v3
        with:
          client-id: ${{ vars.AZURE_CLIENT_ID }}
          tenant-id: ${{ vars.AZURE_TENANT_ID }}
          allow-no-subscriptions: true

      - name: Sign in to the Visual Studio Marketplace
        shell: pwsh
        run: |
          # VsixPublisher ships with the Microsoft.VSSDK.BuildTools package: restore it. Use the copy under bin\lib,
          # which has its dependencies next to it (the one under bin crashes while initializing telemetry).
          msbuild SourceControlSwitcher/SourceControlSwitcher.csproj -t:Restore -v:minimal
          $publisher = Get-ChildItem "$env:USERPROFILE\.nuget\packages\microsoft.vssdk.buildtools" -Recurse -Filter VsixPublisher.exe |
            Where-Object { $_.Directory.Name -eq 'lib' } | Sort-Object FullName -Descending | Select-Object -First 1
          if (-not $publisher) { throw 'VsixPublisher.exe not found' }
          "VSIXPUBLISHER=$($publisher.FullName)" >> $env:GITHUB_ENV

          # An Entra ID access token for Azure DevOps takes the place of the personal access token. VsixPublisher
          # documents PAT authentication only, but accepts the token in its place.
          $azureDevOps = '499b84ac-1321-427f-aa17-267ca6975798'
          $token = az account get-access-token --resource $azureDevOps --query accessToken -o tsv
          if ($LASTEXITCODE -ne 0 -or -not $token) { throw 'Could not get a Microsoft Entra ID token for Azure DevOps.' }
          Write-Output "::add-mask::$token"
          "MARKETPLACE_TOKEN=$token" >> $env:GITHUB_ENV

          # The publisher lists the identity under this id (Manage Publishers > Members).
          $identity = az rest -u 'https://app.vssps.visualstudio.com/_apis/profile/profiles/me?api-version=7.1' --resource $azureDevOps
          if ($LASTEXITCODE -eq 0) {
            $identity = $identity | ConvertFrom-Json
            Write-Host "Azure DevOps profile id of the publishing identity: $($identity.id) ($($identity.displayName))"
          }

          $publisherName = (Get-Content 'SourceControlSwitcher/Manifest/publishManifest.json' -Raw | ConvertFrom-Json).publisher
          & $publisher.FullName login -personalAccessToken $token -publisherName $publisherName -overwrite
          if ($LASTEXITCODE -ne 0) { throw "The Marketplace did not accept the Entra ID token for publisher '$publisherName'." }

      - name: Publish to the Visual Studio Marketplace
        if: github.ref_type == 'tag'
        shell: pwsh
        run: |
          & $env:VSIXPUBLISHER publish `
            -payload 'release/target/Release/SourceControlSwitcher.vsix' `
            -publishManifest 'SourceControlSwitcher/Manifest/publishManifest.json' `
            -personalAccessToken $env:MARKETPLACE_TOKEN
          if ($LASTEXITCODE -ne 0) { throw "VsixPublisher failed with exit code $LASTEXITCODE" }

      - name: Create GitHub release
        if: github.ref_type == 'tag'
        shell: pwsh
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          $tag = $env:GITHUB_REF_NAME
          $vsix = 'release/target/Release/SourceControlSwitcher.vsix'
          gh release view $tag *> $null
          if ($LASTEXITCODE -eq 0) {
            gh release upload $tag $vsix --clobber
          } else {
            gh release create $tag $vsix --verify-tag `
              --title "Source Control Switcher ${{ needs.build.outputs.version }}" --notes-file 'release/release-notes.md'
          }
          if ($LASTEXITCODE -ne 0) { throw "gh release failed with exit code $LASTEXITCODE" }