SwiftLint/.github/workflows/post-release.yml

name: Post Release

on:
  release:
    types: published

jobs:
  setup-credentials:
    name: Setup Actor Credentials
    uses: ./.github/workflows/actor-credentials.yml
    with:
      actor: ${{ github.event.release.author.login }}
    permissions:
      contents: write
    secrets: inherit

  extract-base-branch:
    name: Extract Base Branch
    runs-on: ubuntu-slim
    permissions:
      contents: read
    outputs:
      base-branch: ${{ steps.extract.outputs.base-branch }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.release.tag_name }}
          persist-credentials: false
      - name: Extract base branch from tag message
        id: extract
        run: |
          TAG_MESSAGE=$(git show -s --format=%b "${{ github.event.release.tag_name }}")
          BASE_BRANCH=$(echo "$TAG_MESSAGE" | grep "^Base:" | cut -d: -f2- | xargs)
          if [ -z "$BASE_BRANCH" ]; then
            BASE_BRANCH="main"
          fi
          echo "base-branch=$BASE_BRANCH" >> "$GITHUB_OUTPUT"
      - name: Check non-main release is pre-release
        run: |
          BASE_BRANCH="${{ steps.extract.outputs.base-branch }}"
          IS_PRERELEASE="${{ github.event.release.prerelease }}"

          if [ "$BASE_BRANCH" != "main" ] && [ "$IS_PRERELEASE" != "true" ]; then
            echo "ERROR: Releases from non-main branches must be marked as pre-releases."
            echo "Base branch: $BASE_BRANCH"
            echo "Pre-release: $IS_PRERELEASE"
            exit 1
          fi

  merge-into-base-branch:
    name: Merge into Base Branch
    needs:
      - setup-credentials
      - extract-base-branch
    runs-on: ubuntu-slim
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ needs.extract-base-branch.outputs.base-branch }}
          token: ${{ secrets[format('PERSONAL_GITHUB_TOKEN_{0}', needs.setup-credentials.outputs.author_uppercase)] }}
          persist-credentials: true
      - name: Configure Git author
        uses: Homebrew/actions/git-user-config@main
        with:
          token: ${{ secrets[format('PERSONAL_GITHUB_TOKEN_{0}', needs.setup-credentials.outputs.author_uppercase)] }}
      - name: Merge release branch
        run: |
          git fetch origin "release/${TAG_NAME}"
          git merge --ff-only "origin/release/${TAG_NAME}"
          git push origin "${BASE_BRANCH}"
          git push origin --delete "release/${TAG_NAME}"
        env:
          TAG_NAME: ${{ github.event.release.tag_name }}
          BASE_BRANCH: ${{ needs.extract-base-branch.outputs.base-branch }}

  publish-bcr:
    name: Publish to Bazel Central Registry
    needs:
      - setup-credentials
      - merge-into-base-branch
    if: ${{ !github.event.release.prerelease }}
    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@0a23c53c2baffdaf2ce8dd23c2c0e45eb3b79093 # v1.2.0
    permissions:
      contents: write
    with:
      tag_name: ${{ github.event.release.tag_name }}
      registry_fork: ${{ needs.setup-credentials.outputs.author_lowercase }}/bazel-central-registry
      tag_prefix: ""
      attest: false
      author_name: ${{ needs.setup-credentials.outputs.author_name }}
      author_email: ${{ needs.setup-credentials.outputs.author_email }}
      committer_name: ${{ needs.setup-credentials.outputs.author_name }}
      committer_email: ${{ needs.setup-credentials.outputs.author_email }}
    secrets:
      publish_token: ${{ secrets[format('PERSONAL_GITHUB_TOKEN_{0}', needs.setup-credentials.outputs.author_uppercase)] }}

  publish-pod:
    name: Publish Pod
    needs:
      - setup-credentials
      - merge-into-base-branch
    if: ${{ !github.event.release.prerelease }}
    runs-on: macOS-14
    permissions:
      contents: read
    steps:
      - &checkout-step
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.release.tag_name }}
          persist-credentials: false
      - name: Deploy to CocoaPods
        run: make pod_publish
        env:
          DEVELOPER_DIR: /Applications/Xcode_15.0.1.app
          COCOAPODS_TRUNK_TOKEN: ${{ secrets[format('COCOAPODS_TRUNK_TOKEN_{0}', needs.setup-credentials.outputs.author_uppercase)] }}

  dispatch-plugins:
    name: Dispatch Plugins Repository
    needs:
      - extract-base-branch
      - merge-into-base-branch
    if: ${{ needs.extract-base-branch.outputs.base-branch == 'main' }}
    runs-on: ubuntu-slim
    permissions:
      contents: read
    steps:
      - *checkout-step
      - name: Parse checksum
        id: parse_checksum
        run: echo "checksum=$(grep -o '[a-fA-F0-9]\{64\}' Package.swift)" >> "$GITHUB_OUTPUT"
      - name: Dispatch release of plugins package
        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
        with:
          token: ${{ secrets.SIMPLYDANNY_PLUGINS_SYNC }}
          repository: SimplyDanny/SwiftLintPlugins
          event-type: swiftlint-release
          client-payload: |-
            {
              "title": "${{ github.event.release.name }}",
              "tag": "${{ github.event.release.tag_name }}",
              "checksum": "${{ steps.parse_checksum.outputs.checksum }}",
              "prerelease": ${{ github.event.release.prerelease }}
            }

  bump-homebrew:
    name: Bump Homebrew Formula
    needs:
      - setup-credentials
      - merge-into-base-branch
    if: ${{ !github.event.release.prerelease }}
    runs-on: ubuntu-24.04
    container:
      image: ghcr.io/homebrew/ubuntu24.04:latest
    permissions: {}
    steps:
      - name: Set up Homebrew
        id: set-up-homebrew
        uses: Homebrew/actions/setup-homebrew@main
      - name: Configure Git author
        uses: Homebrew/actions/git-user-config@main
        with:
          token: ${{ secrets[format('PERSONAL_GITHUB_TOKEN_{0}', needs.setup-credentials.outputs.author_uppercase)] }}
      - name: Update Homebrew formula
        uses: Homebrew/actions/bump-packages@main
        with:
          token: ${{ secrets[format('PERSONAL_GITHUB_TOKEN_{0}', needs.setup-credentials.outputs.author_uppercase)] }}
          formulae: swiftlint

  build-docker:
    name: Build Docker Images
    needs:
      - merge-into-base-branch
    uses: ./.github/workflows/docker.yml
    permissions:
      contents: read
      packages: write
    secrets: inherit
    with:
      tag: ${{ github.event.release.tag_name }}