vscode-promote-stable.yml

name: Promote Pre-release to Stable

# Reusable workflow for promoting a pre-release VS Code extension to stable.
#
# Usage from consuming repository:
#   jobs:
#     promote:
#       uses: salesforcecli/github-workflows/.github/workflows/vscode-promote-stable.yml@main
#       with:
#         extension-name: 'apex-lsp-vscode-extension'
#         vsix-name-pattern: 'apex-language-server-extension-*.vsix'
#         exclude-web-vsix: 'true'
#         extensions-root: 'packages'
#         required-ci-checks: '["CI Complete"]'
#         dry-run: 'false'
#       secrets: inherit
#
# Requirements - calling repository must have:
#   - marketplace-prerelease-* tracking tags
#   - Nightly tags matching v{version}-nightly.* pattern
#   - GitHub releases for each nightly tag with VSIX file(s) attached
#   - Passing CI checks on the nightly candidate commit
#   - Secrets: IDEE_GH_TOKEN, VSCE_PERSONAL_ACCESS_TOKEN, IDEE_OVSX_PAT
#   - The shared actions in this repository are resolved from the workflow branch.
#   - The package manager and lockfile inputs must match the caller repository.
#
# The caller supplies credentials and repository-specific paths; action implementations are
# resolved from this repository so callers do not need duplicate composite actions.
#
# Workflow: finds latest pre-release → verifies quality gate → repackages VSIX
#           → publishes to both marketplaces → creates GitHub release → tags stable
#           → commits stable version back to main

on:
  workflow_call:
    inputs:
      extension-name:
        description: 'Extension name for tracking tags (e.g., "apex-lsp-vscode-extension")'
        required: true
        type: string
      vsix-name-pattern:
        description: 'Pattern to match VSIX files in release (e.g., "apex-language-server-extension-*.vsix")'
        required: false
        default: '*.vsix'
        type: string
      exclude-web-vsix:
        description: 'Exclude *-web-* VSIX files from promotion'
        required: false
        default: 'false'
        type: string
      extensions-root:
        description: 'Root directory for extensions (default: packages)'
        required: false
        default: 'packages'
        type: string
      required-ci-checks:
        description: 'JSON array of CI check names required before promotion'
        required: false
        default: '["CI Complete"]'
        type: string
      dry-run:
        description: 'Run in dry-run mode (no actual publishing or tagging)'
        required: false
        default: 'false'
        type: string
      node-version:
        description: 'Node.js version to use'
        required: false
        default: '22.x'
        type: string
      package-manager:
        description: 'Package manager to use: npm, pnpm, or yarn'
        required: false
        default: 'npm'
        type: string
      package-manager-version:
        description: 'pnpm version to use when package-manager is pnpm'
        required: false
        default: '10'
        type: string
      cache-dependency-path:
        description: 'Path to the package manager lockfile'
        required: false
        default: 'package-lock.json'
        type: string
      lockfile-path:
        description: 'Single lockfile path to update and commit with the stable version'
        required: false
        default: 'package-lock.json'
        type: string
      install-command:
        description: 'Command used to install dependencies'
        required: false
        default: 'npm ci'
        type: string
  workflow_dispatch:
    inputs:
      extension-name:
        description: 'Extension name for tracking tags (e.g., "apex-lsp-vscode-extension")'
        required: true
        type: string
      vsix-name-pattern:
        description: 'Pattern to match VSIX files in release (e.g., "apex-language-server-extension-*.vsix")'
        required: false
        default: '*.vsix'
        type: string
      exclude-web-vsix:
        description: 'Exclude *-web-* VSIX files from promotion'
        required: false
        default: 'false'
        type: choice
        options:
          - 'false'
          - 'true'
      extensions-root:
        description: 'Root directory for extensions (default: packages)'
        required: false
        default: 'packages'
        type: string
      required-ci-checks:
        description: 'JSON array of CI check names required before promotion'
        required: false
        default: '["CI Complete"]'
        type: string
      dry-run:
        description: 'Run in dry-run mode (no actual publishing or tagging)'
        required: false
        default: 'false'
        type: choice
        options:
          - 'false'
          - 'true'
      node-version:
        description: 'Node.js version to use'
        required: false
        default: '22.x'
        type: string
      package-manager:
        description: 'Package manager to use: npm, pnpm, or yarn'
        required: false
        default: 'npm'
        type: choice
        options: [npm, pnpm, yarn]
      package-manager-version:
        description: 'pnpm version to use when package-manager is pnpm'
        required: false
        default: '10'
        type: string
      cache-dependency-path:
        description: 'Path to the package manager lockfile'
        required: false
        default: 'package-lock.json'
        type: string
      lockfile-path:
        description: 'Single lockfile path to update and commit with the stable version'
        required: false
        default: 'package-lock.json'
        type: string
      install-command:
        description: 'Command used to install dependencies'
        required: false
        default: 'npm ci'
        type: string

concurrency:
  group: promote-stable
  cancel-in-progress: false

permissions:
  contents: write
  packages: write
  actions: read

jobs:
  find-prerelease-candidate:
    runs-on: ubuntu-latest
    outputs:
      prerelease-version: ${{ steps.find.outputs.prerelease-version }}
      stable-version: ${{ steps.find.outputs.stable-version }}
      nightly-tag: ${{ steps.find.outputs.nightly-tag }}
      commit-sha: ${{ steps.find.outputs.commit-sha }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          token: ${{ secrets.IDEE_GH_TOKEN }}

      - name: Setup Node.js and install dependencies
        uses: salesforcecli/github-workflows/.github/actions/setupNodeAndInstall@main
        with:
          node-version: ${{ inputs.node-version || '22.x' }}
          package-manager: ${{ inputs.package-manager }}
          package-manager-version: ${{ inputs.package-manager-version }}
          cache-dependency-path: ${{ inputs.cache-dependency-path }}
          install-command: ${{ inputs.install-command }}

      - name: Find latest pre-release candidate and compute stable version
        id: find
        env:
          GH_TOKEN: ${{ secrets.IDEE_GH_TOKEN }}
          EXTENSION_NAME: ${{ inputs.extension-name }}
        run: |
          # Find the latest marketplace-prerelease-* tracking tag
          git fetch --tags origin

          PRERELEASE_TAG=$(git tag --list "marketplace-prerelease-${EXTENSION_NAME}-v*" \
            --sort=-version:refname | head -1)

          if [ -z "$PRERELEASE_TAG" ]; then
            echo "No marketplace-prerelease-${EXTENSION_NAME}-v* tracking tags found. Nothing to promote."
            exit 1
          fi

          echo "Found pre-release tracking tag: $PRERELEASE_TAG"

          # Extract version from tag (format: marketplace-prerelease-<pkg>-v<semver>)
          PRERELEASE_VERSION=$(echo "$PRERELEASE_TAG" | grep -oP '\d+\.\d+\.\d+' | head -1)
          if [ -z "$PRERELEASE_VERSION" ]; then
            echo "Could not extract version from tag: $PRERELEASE_TAG"
            exit 1
          fi

          echo "Pre-release version: $PRERELEASE_VERSION"

          # Compute stable version via semver minor bump using Node.js/semver
          STABLE_VERSION=$(node -e "const semver = require('semver'); console.log(semver.inc('$PRERELEASE_VERSION', 'minor'));")
          if [ -z "$STABLE_VERSION" ] || [ "$STABLE_VERSION" = "null" ]; then
            echo "Could not compute stable version from $PRERELEASE_VERSION"
            exit 1
          fi

          echo "Computed stable version: $STABLE_VERSION"

          # Check if stable was already published (floor check)
          STABLE_TRACKING_TAG="marketplace-stable-${EXTENSION_NAME}-v${STABLE_VERSION}"
          if git tag --list "$STABLE_TRACKING_TAG" | grep -q .; then
            echo "Stable version $STABLE_VERSION already published ($STABLE_TRACKING_TAG exists). Nothing to do."
            exit 1
          fi

          # Find the nightly tag that corresponds to this pre-release version
          # It was the nightly that had version $PRERELEASE_VERSION
          NIGHTLY_TAG=$(git tag --list "v${PRERELEASE_VERSION}-nightly*" \
            --sort=-version:refname | head -1)

          if [ -z "$NIGHTLY_TAG" ]; then
            echo "Could not find nightly tag for version $PRERELEASE_VERSION"
            exit 1
          fi

          echo "Corresponding nightly tag: $NIGHTLY_TAG"

          # Get commit SHA from the nightly tag
          COMMIT_SHA=$(git rev-list -n 1 "$NIGHTLY_TAG")
          echo "Commit SHA: $COMMIT_SHA"

          echo "prerelease-version=$PRERELEASE_VERSION" >> $GITHUB_OUTPUT
          echo "stable-version=$STABLE_VERSION" >> $GITHUB_OUTPUT
          echo "nightly-tag=$NIGHTLY_TAG" >> $GITHUB_OUTPUT
          echo "commit-sha=$COMMIT_SHA" >> $GITHUB_OUTPUT

  quality-gate:
    needs: find-prerelease-candidate
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Check CI status for candidate commit
        uses: salesforcecli/github-workflows/.github/actions/check-ci-status@main
        with:
          commit-sha: ${{ needs.find-prerelease-candidate.outputs.commit-sha }}
          token: ${{ secrets.IDEE_GH_TOKEN }}
          # Validate only checks produced on the nightly candidate commit.
          # Without this, the action validates every check-run on the commit — including
          # this workflow's own `quality-gate` job, whose superseded historical runs can
          # carry a stale `failure` conclusion and block all future promotions.
          # `CI Complete` is the aggregate release gate emitted by vscode-ci-template.
          # The marketplace-prerelease tracking tag found above proves prerelease publication.
          # Callers can override the CI check names for their repository.
          required-checks: ${{ inputs.required-ci-checks }}

  repackage:
    needs: [find-prerelease-candidate, quality-gate]
    runs-on: ubuntu-latest
    outputs:
      stable-vsix-path: ${{ steps.repack.outputs.vsix-path }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ inputs.node-version || '22.x' }}

      - name: Download VSIX from nightly GitHub release
        env:
          GH_TOKEN: ${{ secrets.IDEE_GH_TOKEN }}
          NIGHTLY_TAG: ${{ needs.find-prerelease-candidate.outputs.nightly-tag }}
          VSIX_NAME_PATTERN: ${{ inputs.vsix-name-pattern }}
          EXCLUDE_WEB_VSIX: ${{ inputs.exclude-web-vsix }}
        run: |
          mkdir -p ./vsix-artifacts
          echo "Downloading VSIX from release: $NIGHTLY_TAG"
          gh release download "$NIGHTLY_TAG" \
            --pattern "$VSIX_NAME_PATTERN" \
            --dir ./vsix-artifacts \
            --repo "${{ github.repository }}"

          # Find VSIX, excluding web variants if requested
          if [ "$EXCLUDE_WEB_VSIX" = "true" ]; then
            VSIX_FILE=$(find ./vsix-artifacts -type f -name "$VSIX_NAME_PATTERN" ! -name '*-web-*' | head -1)
          else
            VSIX_FILE=$(find ./vsix-artifacts -type f -name "$VSIX_NAME_PATTERN" | head -1)
          fi

          if [ -z "$VSIX_FILE" ]; then
            echo "No VSIX found in release $NIGHTLY_TAG"
            exit 1
          fi
          echo "VSIX_FILE=$VSIX_FILE" >> $GITHUB_ENV

      - name: Repackage VSIX with stable version
        id: repack
        uses: salesforcecli/github-workflows/.github/actions/vscode/repackage-vsix-stable@main
        with:
          source-vsix-path: ${{ env.VSIX_FILE }}
          prerelease-version: ${{ needs.find-prerelease-candidate.outputs.prerelease-version }}
          stable-version: ${{ needs.find-prerelease-candidate.outputs.stable-version }}

      - name: Upload stable VSIX as artifact
        uses: actions/upload-artifact@v7
        with:
          name: stable-vsix
          path: ${{ steps.repack.outputs.vsix-path }}

  publish:
    needs: [find-prerelease-candidate, repackage]
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - registry: vsce
            publish-tool: vsce
          - registry: ovsx
            publish-tool: ovsx
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ inputs.node-version || '22.x' }}

      - name: Download stable VSIX artifact
        uses: actions/download-artifact@v8
        with:
          name: stable-vsix
          path: ./vsix-artifacts

      - name: Locate stable VSIX
        env:
          VSIX_NAME_PATTERN: ${{ inputs.vsix-name-pattern }}
          EXCLUDE_WEB_VSIX: ${{ inputs.exclude-web-vsix }}
        run: |
          # Find VSIX, excluding web variants if requested
          if [ "$EXCLUDE_WEB_VSIX" = "true" ]; then
            VSIX_FILE=$(find ./vsix-artifacts -type f -name "$VSIX_NAME_PATTERN" ! -name '*-web-*' | head -1)
          else
            VSIX_FILE=$(find ./vsix-artifacts -type f -name "$VSIX_NAME_PATTERN" | head -1)
          fi

          if [ -z "$VSIX_FILE" ]; then
            echo "No stable VSIX found in artifact"
            exit 1
          fi
          echo "VSIX_PATH=$VSIX_FILE" >> $GITHUB_ENV

      - name: Publish to ${{ matrix.registry }}
        uses: salesforcecli/github-workflows/.github/actions/publish-vsix@main
        with:
          vsix-path: ${{ env.VSIX_PATH }}
          publish-tool: ${{ matrix.publish-tool }}
          pre-release: 'false'
          dry-run: ${{ inputs.dry-run || 'false' }}
        env:
          VSCE_PERSONAL_ACCESS_TOKEN: ${{ secrets.VSCE_PERSONAL_ACCESS_TOKEN }}
          OVSX_PAT: ${{ secrets.IDEE_OVSX_PAT }}

  create-github-release:
    needs: [find-prerelease-candidate, repackage, publish]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          token: ${{ secrets.IDEE_GH_TOKEN }}

      - name: Download stable VSIX artifact
        uses: actions/download-artifact@v8
        with:
          name: stable-vsix
          path: ./vsix-artifacts

      - name: Create GitHub release for stable version
        env:
          GH_TOKEN: ${{ secrets.IDEE_GH_TOKEN }}
          STABLE_VERSION: ${{ needs.find-prerelease-candidate.outputs.stable-version }}
          PRERELEASE_VERSION: ${{ needs.find-prerelease-candidate.outputs.prerelease-version }}
          NIGHTLY_TAG: ${{ needs.find-prerelease-candidate.outputs.nightly-tag }}
          DRY_RUN: ${{ inputs.dry-run || 'false' }}
          VSIX_NAME_PATTERN: ${{ inputs.vsix-name-pattern }}
          EXCLUDE_WEB_VSIX: ${{ inputs.exclude-web-vsix }}
        run: |
          # Find VSIX, excluding web variants if requested
          if [ "$EXCLUDE_WEB_VSIX" = "true" ]; then
            VSIX_FILE=$(find ./vsix-artifacts -type f -name "$VSIX_NAME_PATTERN" ! -name '*-web-*' | head -1)
          else
            VSIX_FILE=$(find ./vsix-artifacts -type f -name "$VSIX_NAME_PATTERN" | head -1)
          fi

          # Extract base name for release tag (remove version and .vsix)
          # e.g., apex-language-server-extension-1.2.3.vsix -> apex-language-server-extension
          BASE_NAME=$(basename "$VSIX_FILE" .vsix | sed -E 's/-[0-9]+\.[0-9]+\.[0-9]+$//')
          RELEASE_TAG="${BASE_NAME}-v${STABLE_VERSION}"
          RELEASE_TITLE="${BASE_NAME} v${STABLE_VERSION} (stable)"
          RELEASE_NOTES="## Stable Release v${STABLE_VERSION}

          Promoted from pre-release v${PRERELEASE_VERSION} (nightly: ${NIGHTLY_TAG}).

          This is a stable release. Install from the VS Code Marketplace or Open VSX Registry."

          if [ "$DRY_RUN" = "true" ]; then
            echo "DRY RUN: Would create GitHub release $RELEASE_TAG with $VSIX_FILE"
          else
            # Idempotent: check if release already exists
            if gh release view "$RELEASE_TAG" --repo "${{ github.repository }}" &>/dev/null; then
              EXISTING_ASSETS=$(gh release view "$RELEASE_TAG" --repo "${{ github.repository }}" --json assets --jq '.assets | length')
              if [ "$EXISTING_ASSETS" -gt 0 ]; then
                echo "⏭️ GitHub release $RELEASE_TAG already exists with assets — skipping (idempotent rerun)"
              else
                echo "GitHub release $RELEASE_TAG exists but has no assets — uploading VSIX"
                gh release upload "$RELEASE_TAG" "$VSIX_FILE" --repo "${{ github.repository }}"
                echo "VSIX uploaded to existing release: $RELEASE_TAG"
              fi
            else
              gh release create "$RELEASE_TAG" \
                "$VSIX_FILE" \
                --title "$RELEASE_TITLE" \
                --notes "$RELEASE_NOTES" \
                --repo "${{ github.repository }}"
              echo "GitHub release created: $RELEASE_TAG"
            fi
          fi

  tag-stable:
    needs: [find-prerelease-candidate, create-github-release]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          token: ${{ secrets.IDEE_GH_TOKEN }}

      - name: Create marketplace-stable tracking tag
        env:
          STABLE_VERSION: ${{ needs.find-prerelease-candidate.outputs.stable-version }}
          COMMIT_SHA: ${{ needs.find-prerelease-candidate.outputs.commit-sha }}
          DRY_RUN: ${{ inputs.dry-run || 'false' }}
          GH_TOKEN: ${{ secrets.IDEE_GH_TOKEN }}
          EXTENSION_NAME: ${{ inputs.extension-name }}
        run: |
          TRACKING_TAG="marketplace-stable-${EXTENSION_NAME}-v${STABLE_VERSION}"

          echo "Creating tracking tag: $TRACKING_TAG → $COMMIT_SHA"

          if [ "$DRY_RUN" = "true" ]; then
            echo "DRY RUN: Would create and push tag $TRACKING_TAG"
          else
            git config --local user.email "action@github.com"
            git config --local user.name "GitHub Action"
            git remote set-url origin https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git
            git fetch --tags origin
            if git tag --list "$TRACKING_TAG" | grep -q .; then
              echo "⏭️ Tracking tag $TRACKING_TAG already exists — skipping (idempotent rerun)"
            else
              git tag "$TRACKING_TAG" "$COMMIT_SHA"
              git push origin "$TRACKING_TAG"
              echo "Tracking tag pushed: $TRACKING_TAG"
            fi
          fi

  # ── commit-stable-version ────────────────────────────────────────────────
  # Advance main's package.json to the published stable version so the next
  # nightly derives its version from the stable line. With the odd/even minor
  # scheme, an even-minor stable (e.g. 0.6.0) makes the next nightly bump to the
  # next odd minor (0.7.0). Without this, main stays on the old nightly line and
  # the marketplace version diverges from the repo. Idempotent and monotonic:
  # only bumps when stable-version is strictly greater than main's current
  # version, so reruns and out-of-order promotions never move main backwards.
  commit-stable-version:
    needs: [find-prerelease-candidate, create-github-release, tag-stable]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout main
        uses: actions/checkout@v6
        with:
          ref: main
          fetch-depth: 0
          token: ${{ secrets.IDEE_GH_TOKEN }}

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: ${{ inputs.node-version || '22.x' }}

      - name: Update stable version
        id: update-version
        env:
          STABLE_VERSION: ${{ needs.find-prerelease-candidate.outputs.stable-version }}
          DRY_RUN: ${{ inputs.dry-run || 'false' }}
          GH_TOKEN: ${{ secrets.IDEE_GH_TOKEN }}
          EXTENSION_NAME: ${{ inputs.extension-name }}
          EXTENSIONS_ROOT: ${{ inputs.extensions-root }}
        run: |
          set -euo pipefail
          PKG_DIR="${EXTENSIONS_ROOT}/${EXTENSION_NAME}"
          CURRENT_VERSION=$(node -p "require('./$PKG_DIR/package.json').version")
          echo "main version: $CURRENT_VERSION -> stable version: $STABLE_VERSION"

          # Monotonic guard: never move main backwards or sideways.
          # Use semver CLI for reliable version comparison
          if npx --yes semver@7 "$STABLE_VERSION" -r ">$CURRENT_VERSION" >/dev/null 2>&1; then
            IS_GT="yes"
          else
            IS_GT="no"
          fi
          if [ "$IS_GT" != "yes" ]; then
            echo "Skipping commit-back: main ($CURRENT_VERSION) is already >= stable ($STABLE_VERSION)"
            echo "should-commit=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          if [ "$DRY_RUN" = "true" ]; then
            echo "DRY RUN: Would set $PKG_DIR to $STABLE_VERSION and commit to main"
            echo "should-commit=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          git config --local user.email "action@github.com"
          git config --local user.name "GitHub Action"
          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git"

          ( cd "$PKG_DIR" && npm version "$STABLE_VERSION" --no-git-tag-version )

          git add "$PKG_DIR/package.json"
          if git diff --cached --quiet -- "$PKG_DIR/package.json"; then
            echo "Package version was not updated: $PKG_DIR/package.json"
            exit 1
          fi
          echo "should-commit=true" >> "$GITHUB_OUTPUT"

      - name: Refresh lockfile with retries
        if: steps.update-version.outputs.should-commit == 'true'
        uses: salesforcecli/github-workflows/.github/actions/updateNodeLockfile@main
        with:
          package-manager: ${{ inputs.package-manager }}
          package-manager-version: ${{ inputs.package-manager-version }}
          lockfile-path: ${{ inputs.lockfile-path }}

      - name: Commit stable version bump
        if: steps.update-version.outputs.should-commit == 'true'
        env:
          STABLE_VERSION: ${{ needs.find-prerelease-candidate.outputs.stable-version }}
          EXTENSION_NAME: ${{ inputs.extension-name }}
          EXTENSIONS_ROOT: ${{ inputs.extensions-root }}
          LOCKFILE_PATH: ${{ inputs.lockfile-path }}
        run: |
          set -euo pipefail
          git add "$LOCKFILE_PATH"
          if [ -n "$(git diff --name-only)" ]; then
            echo "Lockfile refresh produced unstaged changes:"
            git diff --name-only
            exit 1
          fi

          git commit -m "chore: set stable version $STABLE_VERSION [skip ci]"

          echo "Pushing stable version bump to main..."
          if ! git push origin HEAD:main; then
            echo "Push failed, attempting fetch+rebase and retry..."
            git fetch origin main
            git rebase origin/main
            if ! git push origin HEAD:main; then
              echo "Error: Push failed after rebase. Check branch protection rules."
              exit 1
            fi
          fi
          echo "main package.json set to $STABLE_VERSION"