vscode-kimi-code-cli-launcher/.github/workflows/release.yml at main · TheStreamCode/vscode-kimi-code-cli-launcher · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
name: Release

on:
  push:
    tags:
      - 'v*.*.*'
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag to publish (for example v0.1.5)'
        required: true
        type: string

permissions:
  contents: read

jobs:
  github-release:
    name: Package GitHub release
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Setup Node.js
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: 22
          cache: npm

      - name: Verify tag and package versions
        shell: bash
        run: |
          PACKAGE_VERSION="$(node -p "require('./package.json').version")"
          test "$GITHUB_REF_NAME" = "v$PACKAGE_VERSION"

      - name: Install dependencies
        run: npm ci --ignore-scripts

      - name: Run validation suite
        run: xvfb-run -a npm run check

      - name: Audit locked dependencies
        run: npm run check:security

      - name: Build VSIX
        shell: bash
        run: |
          npm run package
          PACKAGE_VERSION="$(node -p "require('./package.json').version")"
          VSIX="vscode-kimi-code-cli-launcher-$PACKAGE_VERSION.vsix"
          sha256sum "$VSIX" > "$VSIX.sha256"

      - name: Create or update GitHub release
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          PACKAGE_VERSION="$(node -p "require('./package.json').version")"
          VSIX="vscode-kimi-code-cli-launcher-$PACKAGE_VERSION.vsix"
          if gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1; then
            gh release upload "$GITHUB_REF_NAME" "$VSIX" "$VSIX.sha256" --clobber
          else
            gh release create "$GITHUB_REF_NAME" "$VSIX" "$VSIX.sha256" --generate-notes --title "Kimi Code CLI Launcher $GITHUB_REF_NAME" --verify-tag
          fi

  publish:
    name: Publish released VSIX
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      id-token: write

    steps:
      - name: Validate release tag
        env:
          RELEASE_TAG: ${{ inputs.tag }}
        run: |
          set -euo pipefail
          [[ "$RELEASE_TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]

      - name: Download and verify the released VSIX
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ inputs.tag }}
        run: |
          set -euo pipefail
          VSIX="vscode-kimi-code-cli-launcher-${RELEASE_TAG#v}.vsix"
          mkdir -p .release
          gh release download "$RELEASE_TAG" \
            --repo "$GITHUB_REPOSITORY" \
            --pattern "$VSIX" \
            --dir .release
          gh release view "$RELEASE_TAG" \
            --repo "$GITHUB_REPOSITORY" \
            --json assets > release-assets.json
          expected="$(jq -r --arg name "$VSIX" '.assets[] | select(.name == $name) | .digest' release-assets.json)"
          test -n "$expected"
          test "$expected" != "null"
          actual="sha256:$(sha256sum ".release/$VSIX" | awk '{print $1}')"
          test "$actual" = "$expected"
          unzip -p ".release/$VSIX" extension/package.json > vsix-package.json
          test "$(jq -r '.publisher' vsix-package.json)" = "mikesoft"
          test "$(jq -r '.name' vsix-package.json)" = "vscode-kimi-code-cli-launcher"
          test "$(jq -r '.version' vsix-package.json)" = "${RELEASE_TAG#v}"

      - name: Publish to Visual Studio Marketplace
        env:
          RELEASE_TAG: ${{ inputs.tag }}
        run: |
          npx --yes @vscode/vsce@4.1.0 publish \
            --packagePath ".release/vscode-kimi-code-cli-launcher-${RELEASE_TAG#v}.vsix" \
            --oidc --skip-duplicate

      - name: Publish to Open VSX
        env:
          RELEASE_TAG: ${{ inputs.tag }}
        run: |
          npx --yes ovsx@1.3.0 publish \
            --packagePath ".release/vscode-kimi-code-cli-launcher-${RELEASE_TAG#v}.vsix" \
            --trusted-publishing --skip-duplicate