publish.yml

on:
  push:
    tags:
      - "*"

# These permissions are needed to assume roles from Github's OIDC.
permissions:
  contents: write
  id-token: write

name: Publish Extension
jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install devbox
        uses: jetify-com/devbox-install-action@v0.11.0
        with:
          enable-cache: 'true'

      - name: Install vendors
        run: devbox run yarn install --frozen-lockfile

      - name: Compile codebase
        run: devbox run yarn run compile

      - name: Run linters
        run: devbox run yarn run lint

  publish:
    needs: lint

    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install devbox
        uses: jetify-com/devbox-install-action@v0.11.0
        with:
          enable-cache: 'true'

      - name: Install vendors
        run: devbox run yarn install --frozen-lockfile --production

      - id: get-secrets
        uses: grafana/shared-workflows/actions/get-vault-secrets@main
        with:
          # Secrets placed in the ci/repo/grafana/<repo>/<path> path in Vault
          repo_secrets: |
            OPEN_VSX_TOKEN=openvsx:token
            VS_MARKETPLACE_TOKEN=vscode-marketplace:token

      - name: Create extension package
        run: devbox run vsce package --out grafana-vscode.vsix
      
      - name: Publish to Open VSX
        run: devbox run npx --yes ovsx@0.9.4 publish --pat ${{ env.OPEN_VSX_TOKEN }} --packagePath grafana-vscode.vsix
      
      - name: Publish to Visual Studio Marketplace
        run: devbox run vsce publish --pat ${{ env.VS_MARKETPLACE_TOKEN }} --packagePath grafana-vscode.vsix

      - name: Create GitHub release
        uses: ncipollo/release-action@v1
        with:
          allowUpdates: true
          artifacts: "grafana-vscode.vsix"
          token: ${{ secrets.GITHUB_TOKEN }}