release.yaml

# https://docs.github.com/en/actions

name: "Release"

on: # yamllint disable-line rule:truthy
  push:
    tags:
      - "**"

jobs:
  release:
    name: "Release"

    runs-on: "ubuntu-latest"

    timeout-minutes: 5

    strategy:
      matrix:
        php-version:
          - "7.4"

        dependencies:
          - "locked"

    env:
      COMPOSER_NORMALIZE_PHAR: ".build/phar/composer-normalize.phar"
      COMPOSER_NORMALIZE_PHAR_SIGNATURE: ".build/phar/composer-normalize.phar.asc"
      COMPOSER_VERSION: "2.8.3"
      GPG_KEYS: ".build/phar/keys.asc"
      GPG_KEYS_ENCRYPTED: "phar/keys.asc.gpg"

    steps:
      - name: "Checkout"
        uses: "actions/checkout@v4.2.2"

      - name: "Set up PHP"
        uses: "shivammathur/setup-php@2.31.1"
        with:
          coverage: "none"
          extensions: "none, ctype, dom, json, mbstring, phar, simplexml, tokenizer, xml, xmlwriter"
          php-version: "${{ matrix.php-version }}"
          tools: "phive"

      - name: "Determine composer cache directory"
        uses: "ergebnis/.github/actions/composer/determine-cache-directory@1.9.2"

      - name: "Cache dependencies installed with composer"
        uses: "actions/cache@v4.1.2"
        with:
          path: "${{ env.COMPOSER_CACHE_DIR }}"
          key: "php-${{ matrix.php-version }}-composer-${{ matrix.dependencies }}-${{ hashFiles('composer.lock') }}"
          restore-keys: "php-${{ matrix.php-version }}-composer-${{ matrix.dependencies }}-"

      - name: "Install ${{ matrix.dependencies }} dependencies with composer"
        uses: "ergebnis/.github/actions/composer/install@1.9.2"
        with:
          dependencies: "${{ matrix.dependencies }}"

      - name: "Remove incompatible dependencies with composer"
        run: "composer remove phpstan/extension-installer --ansi --dev --no-interaction --no-progress"

      - name: "Require composer/composer"
        run: "composer require composer/composer:${{ env.COMPOSER_VERSION }} --ansi --no-interaction --no-progress"

      - name: "Install dependencies with phive"
        uses: "ergebnis/.github/actions/phive/install@1.9.2"
        with:
          trust-gpg-keys: "0xC00543248C87FB13,0x033E5F8D801A2F8D,0x2DF45277AEF09A2F"

      - name: "Validate configuration for humbug/box"
        run: ".phive/box validate box.json --ansi"

      - name: "Compile composer-normalize.phar with humbug/box"
        run: ".phive/box compile --ansi --config=box.json"

      - name: "Show info about composer-normalize.phar with humbug/box"
        run: ".phive/box info ${{ env.COMPOSER_NORMALIZE_PHAR }} --ansi --list"

      - name: "Run composer-normalize.phar"
        run: "${{ env.COMPOSER_NORMALIZE_PHAR }}"

      - name: "Show gpg version"
        run: "gpg --version"

      - name: "Decrypt keys.asc.gpg with gpg"
        run: "gpg --batch --output ${{ env.GPG_KEYS }} --passphrase \"${{ secrets.GPG_DECRYPT_PASSPHRASE }}\" --yes --decrypt ${{ env.GPG_KEYS_ENCRYPTED }}"

      - name: "Import keys from keys.asc with gpg"
        run: "gpg --batch --import ${{ env.GPG_KEYS }}"

      - name: "Sign composer-normalize.phar with gpg"
        run: "gpg --armor --local-user \"${{ secrets.GPG_LOCAL_USER }}\" --output ${{ env.COMPOSER_NORMALIZE_PHAR_SIGNATURE }} --passphrase \"${{ secrets.GPG_KEY_PASSPHRASE }}\" --pinentry-mode loopback --yes --detach-sig ${{ env.COMPOSER_NORMALIZE_PHAR }}"

      - name: "Remove decrypted keys.asc"
        run: "rm ${{ env.GPG_KEYS }}"

      - name: "Determine tag"
        run: "echo \"RELEASE_TAG=${GITHUB_REF#refs/tags/}\" >> $GITHUB_ENV"

      - name: "Create release"
        uses: "ergebnis/.github/actions/github/release/create@1.9.2"
        with:
          github-token: "${{ secrets.ERGEBNIS_BOT_TOKEN }}"

      - name: "Upload release assets"
        uses: "actions/github-script@v7.0.1"
        with:
          github-token: "${{ secrets.ERGEBNIS_BOT_TOKEN }}"
          script: |
            const fs = require("fs");

            const files = [
              {
                name: "composer-normalize.phar",
                path: process.env.COMPOSER_NORMALIZE_PHAR,
              },
              {
                name: "composer-normalize.phar.asc",
                path: process.env.COMPOSER_NORMALIZE_PHAR_SIGNATURE,
              },
            ];

            for (const file of files) {
              try {
                await github.rest.repos.uploadReleaseAsset({
                  data: fs.readFileSync(file.path),
                  name: file.name,
                  origin: process.env.RELEASE_UPLOAD_URL,
                  owner: context.repo.owner,
                  release_id: process.env.RELEASE_ID,
                  repo: context.repo.repo,
                });
              } catch (error) {
                core.setFailed(error.message);
              }
            }

      - name: "Post to twitter.com about release"
        uses: "Eomm/why-don-t-you-tweet@v2.0.0"
        env:
          TWITTER_ACCESS_TOKEN: "${{ secrets.ERGEBNIS_TWITTER_ACCESS_TOKEN }}"
          TWITTER_ACCESS_TOKEN_SECRET: "${{ secrets.ERGEBNIS_TWITTER_ACCESS_TOKEN_SECRET }}"
          TWITTER_CONSUMER_API_KEY: "${{ secrets.ERGEBNIS_TWITTER_CONSUMER_API_KEY }}"
          TWITTER_CONSUMER_API_SECRET: "${{ secrets.ERGEBNIS_TWITTER_CONSUMER_API_KEY_SECRET }}"
        with:
          tweet-message: |
            🎵 Just released: ${{ github.event.repository.owner.login }}/${{ github.event.repository.name }}:${{ env.RELEASE_TAG }}.

            ${{ env.RELEASE_HTML_URL }}