release.yml

name: Release
run-name: "Release ${{ github.event_name == 'push' && 'insider (push to main)' || format('{0} from {1}', inputs.channel, inputs.ref || 'main') }}"

# The single publishing pipeline for both the insider and the stable extension.
#
# - A push to main publishes an insider release.
# - A manual dispatch publishes an insider or stable release, optionally from
#   an x.y.x patch branch (`ref`).
#
# This workflow never writes to the repository. The next extension version is
# derived from the git release tags (`x.y.z` for stable, `insider/x.y.z` for
# insider), and Prisma CLI dependency updates are a separate workflow
# (bump_prisma.yml) that commits to main. Only the `release` job holds write
# access, to create the tag and GitHub release.

on:
  push:
    branches:
      - main
    paths-ignore:
      - '.github/**'
  workflow_dispatch:
    inputs:
      channel:
        description: 'Release channel'
        required: true
        type: choice
        options:
          - insider
          - stable
        default: insider
      ref:
        description: 'Branch to release from. Defaults to main. Use an x.y.x branch to patch an older version.'
        required: false
      bump:
        description: 'Extension version bump (stable only; insider is always a patch)'
        required: false
        type: choice
        options:
          - patch
          - minor
          - major
        default: patch

concurrency:
  group: release
  cancel-in-progress: false

permissions:
  contents: read

env:
  ENVIRONMENT: ${{ secrets.ENVIRONMENT }}
  PRISMA_TELEMETRY_INFORMATION: 'language-tools release.yml'
  NODE_VERSION: '24'

jobs:
  plan:
    name: Plan release
    if: github.repository == 'prisma/language-tools'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    outputs:
      channel: ${{ steps.params.outputs.channel }}
      ref: ${{ steps.params.outputs.ref }}
      sha: ${{ steps.sha.outputs.sha }}
      version: ${{ steps.version.outputs.version }}
      tag_name: ${{ steps.version.outputs.tag_name }}
      asset_name: ${{ steps.version.outputs.asset_name }}
      npm_channel: ${{ steps.version.outputs.npm_channel }}
      ls_npm_tag: ${{ steps.version.outputs.ls_npm_tag }}
    steps:
      - name: Resolve channel and branch
        id: params
        env:
          EVENT_NAME: ${{ github.event_name }}
          WORKFLOW_REF: ${{ github.ref }}
          PUSH_SHA: ${{ github.sha }}
          INPUT_CHANNEL: ${{ inputs.channel }}
          INPUT_REF: ${{ inputs.ref }}
        run: |
          if [ "$EVENT_NAME" = "push" ]; then
            CHANNEL=insider
            REF="$PUSH_SHA"
          else
            if [ "$WORKFLOW_REF" != "refs/heads/main" ]; then
              echo "Refusing to release from workflow ref '$WORKFLOW_REF'. Marketplace authentication is federated to main." >&2
              exit 1
            fi
            CHANNEL="$INPUT_CHANNEL"
            REF="${INPUT_REF:-main}"
            case "$REF" in
              main) ;;
              *)
                if ! echo "$REF" | grep -Eq '^[0-9]+\.[0-9]+\.x$'; then
                  echo "Refusing to release from '$REF'. Releases run from main or an x.y.x patch branch." >&2
                  exit 1
                fi
                ;;
            esac
          fi
          {
            echo "channel=$CHANNEL"
            echo "ref=$REF"
          } >> "$GITHUB_OUTPUT"
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ steps.params.outputs.ref }}
          fetch-depth: 0 # all branches and tags: the next version is derived from release tags
          persist-credentials: false
      - name: Install pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
      - name: Use Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
      - name: Install Dependencies
        run: pnpm install
      - name: Compute next extension version
        id: version
        env:
          CHANNEL: ${{ steps.params.outputs.channel }}
          BUMP: ${{ inputs.bump || 'patch' }}
        run: node scripts/next_extension_version.mjs "$CHANNEL" "$BUMP"
      - name: Resolve release commit
        id: sha
        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

  test:
    name: Test (${{ matrix.os }})
    needs: [plan]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 25
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.plan.outputs.sha }}
          persist-credentials: false
      - name: Install pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
      - name: Use Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
      - name: Install Dependencies
        run: pnpm install
      - name: Build all packages
        run: pnpm build
      - name: Typecheck all packages
        run: pnpm typecheck
      - name: Run Language Server tests
        run: pnpm --filter @prisma/language-server test
      - name: Headless E2E tests
        uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1.0.1
        with:
          run: pnpm test:e2e

  publish-language-server:
    name: Publish Language Server to npm
    needs: [plan, test]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      id-token: write
    env:
      NPM_CHANNEL: ${{ needs.plan.outputs.npm_channel }}
      VERSION: ${{ needs.plan.outputs.version }}
      LS_NPM_TAG: ${{ needs.plan.outputs.ls_npm_tag }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.plan.outputs.sha }}
          persist-credentials: false
      - name: Install pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
      - name: Use Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
      - name: Install Dependencies
        run: pnpm install
      - name: Set Language Server version
        run: node scripts/update_package_json_files.mjs "$NPM_CHANNEL" "$VERSION"
      - name: Build Language Server
        run: pnpm --filter @prisma/language-server build
      - name: Publish Language Server to npm
        run: pnpm --filter @prisma/language-server publish --tag "$LS_NPM_TAG" --access public --no-git-checks

  package:
    name: Build extension
    needs: [plan, test]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    env:
      CHANNEL: ${{ needs.plan.outputs.channel }}
      NPM_CHANNEL: ${{ needs.plan.outputs.npm_channel }}
      VERSION: ${{ needs.plan.outputs.version }}
      ASSET_FILE: ${{ needs.plan.outputs.asset_name }}-${{ needs.plan.outputs.version }}.vsix
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.plan.outputs.sha }}
          persist-credentials: false
      - name: Install pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
      - name: Use Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
      - name: Install Dependencies
        run: pnpm install
      - name: Set extension name and version
        run: node scripts/update_package_json_files.mjs "$NPM_CHANNEL" "$VERSION"
      - name: Replace Readme for marketplace
        run: node scripts/change_readme.mjs "$CHANNEL"
      - name: Build all packages
        run: pnpm build
      - name: Build vsix
        run: cd packages/vscode && pnpm package
      - name: Upload vsix as workflow artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: vsix
          path: packages/vscode/${{ env.ASSET_FILE }}
          if-no-files-found: error

  release:
    name: Create GitHub release
    needs: [plan, package]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
    env:
      CHANNEL: ${{ needs.plan.outputs.channel }}
      TAG_NAME: ${{ needs.plan.outputs.tag_name }}
      ASSET_FILE: ${{ needs.plan.outputs.asset_name }}-${{ needs.plan.outputs.version }}.vsix
      SHA: ${{ needs.plan.outputs.sha }}
      GH_TOKEN: ${{ github.token }}
      GH_REPO: ${{ github.repository }}
    steps:
      - name: Download vsix artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: vsix
      - name: Create GitHub release
        run: |
          PRERELEASE=""
          if [ "$CHANNEL" = "insider" ]; then PRERELEASE="--prerelease"; fi
          gh release create "$TAG_NAME" "$ASSET_FILE" \
            --title "$TAG_NAME" \
            --target "$SHA" \
            $PRERELEASE

  publish-marketplace:
    name: Publish to VS Code Marketplace
    needs: [plan, release]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      id-token: write # Required by azure/login and vsce --azure-credential.
    env:
      ASSET_FILE: ${{ needs.plan.outputs.asset_name }}-${{ needs.plan.outputs.version }}.vsix
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.plan.outputs.sha }}
          persist-credentials: false
      - name: Install pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
      - name: Use Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
      - name: Install Dependencies
        run: pnpm install
      - name: Download vsix artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: vsix
      - name: Log in to Azure
        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          allow-no-subscriptions: true
      - name: Publish vsix to marketplace
        run: >-
          cd packages/vscode && npx vsce publish --azure-credential --packagePath "$GITHUB_WORKSPACE/$ASSET_FILE"

  publish-open-vsx:
    name: Publish to open-vsx
    needs: [plan, release]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    env:
      ASSET_FILE: ${{ needs.plan.outputs.asset_name }}-${{ needs.plan.outputs.version }}.vsix
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.plan.outputs.sha }}
          persist-credentials: false
      - name: Install pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
      - name: Use Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'
      - name: Install Dependencies
        run: pnpm install
      - name: Download vsix artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: vsix
      - name: Publish vsix to open-vsx.org
        env:
          OVSX_PAT: ${{ secrets.OPEN_VSX_ACCESS_TOKEN }}
        run: >-
          cd packages/vscode && npx ovsx --debug publish "$GITHUB_WORKSPACE/$ASSET_FILE"