PasswordGeneratorExtension/.github/workflows/cd_pipeline.yaml

name: Release pipeline

on:
  release:
    types: [ released ]
  workflow_dispatch:
    inputs:
      bypass_audit:
        description: Bypass npm audit
        type: boolean
        default: false
      targets:
        description: Targets
        required: true
        default: '["chrome","firefox"]'
        type: choice
        options:
          - '["chrome","firefox"]'
          - '["chrome"]'
          - '["firefox"]'
      firefox:
        description: Deploy Firefox
        type: boolean
        default: true
      chrome:
        description: Deploy Chrome
        type: boolean
        default: true
      edge:
        description: Deploy Edge
        type: boolean
        default: true
      gh-release:
        description: Attach to GitHub release
        type: boolean
        default: true

jobs:
  build:
    runs-on: ubuntu-latest
    container: node:20
    strategy:
      fail-fast: false
      matrix:
        target: ${{ fromJSON(github.event.inputs.targets || '["chrome","firefox"]') }}

    steps:
      - uses: actions/checkout@main

      - run: npm install
      - run: npm run zip -- -b ${{ matrix.target }}

      - name: Drop build artifacts (${{ matrix.target }})
        uses: actions/upload-artifact@main
        with:
          name: ${{ matrix.target }}
          path: ./.output/password-generator-*-${{ matrix.target }}.zip
          include-hidden-files: true

      - name: web-ext lint
        if: ${{ matrix.target == 'firefox' }}
        uses: freaktechnik/web-ext-lint@main
        with:
          extension-root: ./.output/firefox-mv3
          self-hosted: false

      - run: npm audit
        if: ${{ github.event_name == 'release' || github.event.inputs.bypass_audit == 'false' }}

  publish-github:
    needs: build
    if: ${{ github.event_name == 'release' || github.event.inputs.gh-release == 'true' }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        target: ${{ fromJSON(github.event.inputs.targets || '["chrome","firefox"]') }}

    steps:
      - uses: actions/download-artifact@main
        with:
          name: ${{ matrix.target }}

      - name: Attach build to release
        uses: xresloader/upload-to-github-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          file: password-generator-*-${{ matrix.target }}.zip
          draft: false
          overwrite: true
          update_latest_release: true

  publish-chrome:
    needs: build
    if: ${{ github.event_name == 'release' || (github.event.inputs.chrome == 'true' && contains(github.event.inputs.targets, 'chrome')) }}
    runs-on: ubuntu-latest

    steps:
      - uses: actions/download-artifact@main
        with:
          name: chrome

      - uses: wdzeng/chrome-extension@v2.0.1
        with:
          extension-id: jnjobgjobffgmgfnkpkjfjkkfhfikmfl
          zip-path: password-generator-*-chrome.zip
          client-id: ${{ secrets.CHROME_CLIENT_ID }}
          client-secret: ${{ secrets.CHROME_CLIENT_SECRET }}
          refresh-token: ${{ secrets.CHROME_REFRESH_TOKEN }}

  publish-edge:
    needs: build
    if: ${{ github.event_name == 'release' || (github.event.inputs.edge == 'true' && contains(github.event.inputs.targets, 'chrome')) }}
    runs-on: ubuntu-latest

    steps:
      - uses: actions/download-artifact@main
        with:
          name: chrome

      - uses: wdzeng/edge-addon@v2.1.1
        with:
          product-id: ${{ secrets.EDGE_PRODUCT_ID }}
          zip-path: password-generator-*-chrome.zip
          client-id: ${{ secrets.EDGE_CLIENT_ID }}
          api-key: ${{ secrets.EDGE_API_KEY }}

  publish-firefox:
    needs: build
    if: ${{ github.event_name == 'release' || (github.event.inputs.firefox == 'true' && contains(github.event.inputs.targets, 'firefox')) }}
    runs-on: ubuntu-latest

    steps:
      - uses: actions/download-artifact@main
        with:
          name: firefox

      - uses: wdzeng/firefox-addon@v1.2.1
        with:
          addon-guid: ${{ secrets.FIREFOX_EXT_UUID }}
          xpi-path: password-generator-*-firefox.zip
          jwt-issuer: ${{ secrets.FIREFOX_API_KEY }}
          jwt-secret: ${{ secrets.FIREFOX_CLIENT_SECRET }}