release.yml

name: Publish stable release

on:
  workflow_dispatch:
    inputs:
      version:
        description: Stable SemVer from the newest releases.json entry
        required: true
        type: string

concurrency:
  group: stable-release-${{ inputs.version }}
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Require the release branch or matching retry tag
        shell: bash
        env:
          RELEASE_VERSION: ${{ inputs.version }}
        run: |
          if [[ "$GITHUB_REF" != refs/heads/release && "$GITHUB_REF" != "refs/tags/v${RELEASE_VERSION}" ]]; then
            echo "Stable releases must start from release or retry from their matching version tag."
            exit 1
          fi
      - name: Check out release commit
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 26
          cache: npm
      - name: Install locked dependencies
        run: npm ci
      - name: Generate installable app icons
        run: npm run generate:icons
      - name: Validate version and release notes
        env:
          RELEASE_VERSION: ${{ inputs.version }}
        run: node scripts/release-notes.js validate "$RELEASE_VERSION"
      - name: Verify an existing version tag is safe to resume
        shell: bash
        env:
          RELEASE_VERSION: ${{ inputs.version }}
        run: |
          existing=$(git rev-list -n 1 "v${RELEASE_VERSION}" 2>/dev/null || true)
          if [[ -n "$existing" && "$existing" != "$GITHUB_SHA" ]]; then
            echo "v${RELEASE_VERSION} already targets ${existing}, not ${GITHUB_SHA}."
            exit 1
          fi
      - name: Audit production dependencies
        run: npm audit --omit=dev
      - name: Run tests
        run: npm test
      - name: Check JavaScript syntax
        run: npm run check
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
      - name: Build stable container without publishing
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          push: false
          load: true
          tags: js-playground:release-candidate
          build-args: |
            BUILD_VERSION=${{ inputs.version }}
            BUILD_CHANNEL=stable
          cache-from: type=gha
          cache-to: type=gha,mode=max
      - name: Build pinned vulnerability scanner
        run: docker build --file security/Dockerfile --tag arcade-trivy:release security
      - name: Scan stable container for fixable high-severity vulnerabilities
        run: >
          docker run --rm
          --volume /var/run/docker.sock:/var/run/docker.sock
          arcade-trivy:release image
          --scanners vuln
          --ignore-unfixed
          --severity HIGH,CRITICAL
          --exit-code 1
          js-playground:release-candidate
      - name: Create immutable release tag
        shell: bash
        env:
          RELEASE_VERSION: ${{ inputs.version }}
        run: |
          if ! git rev-parse --verify "refs/tags/v${RELEASE_VERSION}" >/dev/null 2>&1; then
            git config user.name "github-actions[bot]"
            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
            git tag --annotate "v${RELEASE_VERSION}" --message "JavaScript Playground ${RELEASE_VERSION}" "$GITHUB_SHA"
            git push origin "refs/tags/v${RELEASE_VERSION}"
          fi
      - name: Set up QEMU
        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
      - name: Log in to Docker Hub
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Generate stable image tags and labels
        id: metadata
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ${{ secrets.DOCKERHUB_USERNAME }}/js-playground
          tags: |
            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/release' }}
            type=semver,pattern={{version}},value=${{ inputs.version }}
            type=semver,pattern={{major}}.{{minor}},value=${{ inputs.version }},enable=${{ github.ref == 'refs/heads/release' }}
            type=sha,prefix=sha-
      - name: Build and push multi-platform stable image
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.metadata.outputs.tags }}
          labels: ${{ steps.metadata.outputs.labels }}
          build-args: |
            BUILD_VERSION=${{ inputs.version }}
            BUILD_CHANNEL=stable
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: mode=max
          sbom: true
      - name: Render GitHub release notes
        env:
          RELEASE_VERSION: ${{ inputs.version }}
        run: node scripts/release-notes.js markdown "$RELEASE_VERSION" "$RUNNER_TEMP/release-notes.md"
      - name: Create GitHub Release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_VERSION: ${{ inputs.version }}
        run: |
          release_title=$(node scripts/release-notes.js title "$RELEASE_VERSION")
          if ! gh release view "v${RELEASE_VERSION}" >/dev/null 2>&1; then
            latest_flag=--latest=false
            if [[ "$GITHUB_REF" == refs/heads/release ]]; then
              latest_flag=--latest
            fi
            gh release create "v${RELEASE_VERSION}" --verify-tag --title "$release_title" --notes-file "$RUNNER_TEMP/release-notes.md" "$latest_flag"
          fi