release.yml

name: GitHub Release
on:
  workflow_dispatch:
    inputs:
      version:
        description: "Version number to release"
        required: true
      overwrite_existing:
        description: "Overwrite version if already published to Galaxy"
        required: false
        type: boolean
        default: false

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: true

# Deny all permissions at workflow level - scope per job
permissions: {}

env:
  GHP_BASE_URL: https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }}

jobs:
  release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    permissions:
      contents: write  # Required for creating releases and tags
    env:
      VERSION: ${{ github.event.inputs.version }}  # zizmor: ignore[template-injection] -- User input is required for this workflow
      OVERWRITE_EXISTING: ${{ github.event.inputs.overwrite_existing }}  # zizmor: ignore[template-injection] -- Boolean input is safe for this comparison
      GHP_BASE_URL: https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }}
      GALAXY_API_KEY: ${{ secrets.GALAXY_API_KEY }}  # zizmor: ignore[secrets-outside-env] -- Galaxy API key needed for publishing; workflow_dispatch only
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # zizmor: ignore[secrets-outside-env] -- GitHub token needed for release creation; workflow_dispatch only
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: 3.8

      - name: Install PyYaml
        run: pip install pyyaml

      - name: Validate version matches galaxy.yml
        run: |
          GALAXY_VERSION=$(python -c "import yaml; print(yaml.safe_load(open('galaxy.yml'))['version'])")
          if [ "${GALAXY_VERSION}" != "${VERSION}" ]; then
            echo "::error::Input version '${VERSION}' does not match galaxy.yml version '${GALAXY_VERSION}'."
            exit 1
          fi
          echo "Version ${VERSION} matches galaxy.yml"

      - name: Check if version exists on Galaxy
        id: check_galaxy_version
        run: |
          if curl --head -s -f -o /dev/null "https://galaxy.ansible.com/download/lowlydba-sqlserver-${VERSION}.tar.gz"; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
            echo "Version ${VERSION} already exists on Galaxy"
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
            echo "Version ${VERSION} does not yet exist on Galaxy"
          fi

      - name: Abort if version exists and overwrite not enabled
        if: steps.check_galaxy_version.outputs.exists == 'true' && env.OVERWRITE_EXISTING != 'true'
        run: |
          echo "::error::Version ${VERSION} already exists on Galaxy. Set overwrite_existing=true to overwrite."
          exit 1

      - name: Publish to Galaxy
        uses: artis3n/ansible_galaxy_collection@ffbca2460a5a1c600b941bbf1536bd61de1c2227 # v3.0.0
        with:
          api_key: ${{ env.GALAXY_API_KEY }}

      - name: Upload collection artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: lowlydba-sqlserver-${{ env.VERSION }}
          path: ${{ github.workspace }}/lowlydba-sqlserver-${{ env.VERSION }}.tar.gz

      - name: Validate version is published to Galaxy
        run: curl --head -s -f -o /dev/null "https://galaxy.ansible.com/download/lowlydba-sqlserver-${VERSION}.tar.gz"

      - name: Build release description
        shell: python
        env:
          VERSION: ${{ env.VERSION }}
          GHP_BASE_URL: ${{ env.GHP_BASE_URL }}
        run: |
          import os
          import yaml

          ver = os.environ['VERSION']
          ver_anchor = str.replace(ver, '.', '-')

          with open('changelogs/changelog.yaml', 'r') as s:
              ri = yaml.safe_load(s)

          if ('release_summary' not in ri['releases'][ver]['changes']):
            summary = 'No release summary available.'
          else:
            summary = ri['releases'][ver]['changes']['release_summary']

          reldate = ri['releases'][ver]['release_date']

          description = '''## Summary
          Released: %s

          %s

          ---

          View the [complete changelog](https://github.com/lowlydba/lowlydba.sqlserver/blob/main/CHANGELOG.rst#v%s) to see all changes.

          View the [full documentation for release %s](%s/tag/%s).
          ''' % (reldate, summary, ver_anchor, ver, os.environ['GHP_BASE_URL'], ver)

          with open(os.environ['GITHUB_ENV'], 'a') as e:
              e.write("RELEASE_DESCRIPTION<<EOF\n%s\nEOF" % description)

      - name: Create Release
        run: |
          gh release create "${VERSION}" \
            --title "${VERSION}" \
            --notes "${RELEASE_DESCRIPTION}"