release.yaml

name: Release
permissions:
  id-token: write
  contents: write

on:
  release:
    types:
      - published

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4.1.7
      - name: Build
        env:
          VERSION: ${{ github.event.release.tag_name }}
        run:  make

      - name: Upload to GitHub release assets
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          UPLOAD_URL: ${{ github.event.release.upload_url }}
          VERSION: ${{ github.event.release.tag_name }}
        run: |
          set +e
          for variant in firefox chrome; do
            name="mergify-${variant}-${VERSION}.zip"

            curl -L \
              --fail \
              -X POST \
              -H "Accept: application/vnd.github+json" \
              -H "Authorization: Bearer $GITHUB_TOKEN" \
              -H "Content-Type: application/octet-stream" \
              --data-binary "@${name}" \
              "${UPLOAD_URL%%/assets*}/assets?name=${name}"

            if [ $? = 22 ]; then
               echo "Upload of $name failed"
               exit 22
            fi

          done
          set -e

      - name: Setup Google Auth 🔧
        id: auth
        # yamllint disable-line rule:line-length
        # nosemgrep: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
        uses: google-github-actions/auth@v2
        with:
          # yamllint disable-line rule:line-length
          workload_identity_provider: projects/306279023132/locations/global/workloadIdentityPools/github/providers/github
          service_account: github-actions@chrome-web-store-api-435512.iam.gserviceaccount.com
          token_format: access_token

      - name: Upload to Google Web Store
        env:
          VERSION: ${{ github.event.release.tag_name }}
          GOOGLE_CHROME_WEBSTORE_APP_ID: ${{ secrets.GOOGLE_CHROME_WEBSTORE_APP_ID }}
          GOOGLE_CHROME_WEBSTORE_TOKEN: ${{ steps.auth.outputs.access_token }}
        run: |
            name="mergify-chrome-${VERSION}.zip"
            curl \
              -v \
              --fail \
              -H "Authorization: Bearer ${GOOGLE_CHROME_WEBSTORE_TOKEN}"  \
              -H "x-goog-api-version: 2" \
              -X PUT \
              -T "$name" \
              "https://www.googleapis.com/upload/chromewebstore/v1.1/items/${GOOGLE_CHROME_WEBSTORE_APP_ID}"
            curl -v \
              --fail \
              -H "Authorization: Bearer $GOOGLE_CHROME_WEBSTORE_TOKEN"  \
              -H "x-goog-api-version: 2" \
              -H "Content-Length: 0" \
              -X POST \
              "https://www.googleapis.com/chromewebstore/v1.1/items/${GOOGLE_CHROME_WEBSTORE_APP_ID}/publish"