release-phase-2.yml

# Copyright (c) Microsoft Corporation.
# Licensed under the MIT License.

---
name: Release – Phase 2

on:
  push:
    branches:
      - main
    paths:
      - .github/workflows/support/release-trigger.txt
  workflow_dispatch: null

permissions: {}

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    permissions: {}
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
        with:
          disable-sudo: true
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Install Node.js
        uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
        with:
          node-version: 20.16.0

      - name: npm – Install Dependencies
        run: npm ci

      - name: npm – Build
        run: npm run build:release

      - name: Release – Create
        run: npx tfx-cli extension create --manifest-globs vss-extension.json --output-path ../ms-omex.PRMetrics.vsix
        working-directory: ${{ github.workspace }}/release

      - name: Release – Publish
        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
        with:
          name: ms-omex.PRMetrics
          path: ${{ github.workspace }}/ms-omex.PRMetrics.vsix

      - name: Get Version
        id: version
        shell: pwsh
        run: |-
          $Version = Get-Content -Path '.github/workflows/support/release-trigger.txt'
          Write-Output -InputObject "VERSION=v$Version" >> $Env:GITHUB_OUTPUT

      - name: GitHub Release
        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v0.1.15
        with:
          discussion_category_name: Releases
          files: ${{ github.workspace }}/ms-omex.PRMetrics.vsix
          generate_release_notes: true
          name: Release ${{ steps.version.outputs.VERSION }}
          tag_name: ${{ steps.version.outputs.VERSION }}
          # Fine-grained Personal Access Token (PAT) with the following permissions for microsoft/PR-Metrics:
          # - Read access to Metadata
          # - Read and Write access to Code (aka Contents) and Discussions
          token: ${{ secrets.RELEASE_PHASE_2_GITHUB_RELEASE }}