release.yaml

name: Release

on:
  workflow_dispatch:
    inputs:
      tag:
        description: Package version and Git tag (for example 1.7.1).
        required: true
        type: string
  release:
    types: [published]

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  prepare:
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-24.04
    env:
      TARGET_FILE: ./Assets/MackySoft/MackySoft.SerializeReferenceExtensions/package.json
    outputs:
      sha: ${{ steps.metadata.outputs.sha }}
      version: ${{ steps.metadata.outputs.version }}
      asset_basename: ${{ steps.metadata.outputs.asset_basename }}
    steps:
      - name: Check signing credentials
        env:
          UPM_SERVICE_ACCOUNT_KEY_ID: ${{ secrets.UPM_SERVICE_ACCOUNT_KEY_ID }}
          UPM_SERVICE_ACCOUNT_KEY_SECRET: ${{ secrets.UPM_SERVICE_ACCOUNT_KEY_SECRET }}
          UPM_ORG_ID: ${{ secrets.UPM_ORG_ID }}
        run: |
          for setting in UPM_SERVICE_ACCOUNT_KEY_ID UPM_SERVICE_ACCOUNT_KEY_SECRET UPM_ORG_ID; do
            if [[ -z "${!setting}" ]]; then
              echo "::error::Repository secret $setting is required for signed OpenUPM releases."
              exit 1
            fi
          done

      # The Git tracker must stop packing unsigned source before a new tag exists.
      - name: Require OpenUPM release asset tracking
        run: |
          curl --fail --silent --show-error --location \
            https://raw.githubusercontent.com/openupm/openupm/master/data/packages/com.mackysoft.serializereference-extensions.yml \
            --output "$RUNNER_TEMP/openupm-package.yml"
          if ! yq --exit-status \
            '.trackingMode == "githubRelease" and .githubReleaseAssetName == "com.mackysoft.serializereference-extensions-"' \
            "$RUNNER_TEMP/openupm-package.yml" > /dev/null; then
            echo "::error::Merge the OpenUPM metadata change to signed GitHub Release assets before releasing."
            exit 1
          fi

      - name: Create release app token
        id: release_app
        uses: actions/create-github-app-token@v3
        with:
          # GitHub accepts the existing App ID as a JWT issuer, as well as a client ID.
          client-id: ${{ vars.RELEASE_BOT_APP_ID }}
          private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
          permission-contents: write

      - uses: actions/checkout@v7
        with:
          ref: ${{ github.ref }}
          token: ${{ steps.release_app.outputs.token }}

      - name: Configure release app identity
        env:
          APP_SLUG: ${{ steps.release_app.outputs.app-slug }}
          GH_TOKEN: ${{ steps.release_app.outputs.token }}
        run: |
          bot_login="${APP_SLUG}[bot]"
          bot_id="$(gh api "/users/${APP_SLUG}%5Bbot%5D" --jq '.id')"
          git config user.name "$bot_login"
          git config user.email "${bot_id}+${bot_login}@users.noreply.github.com"

      - name: Prepare release version
        id: metadata
        env:
          VERSION: ${{ inputs.tag }}
          RELEASE_REF: ${{ github.ref }}
        run: bash .github/scripts/release.sh prepare

  sign-upm:
    needs: prepare
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.prepare.outputs.sha }}

      - name: Install Unity UPM CLI
        run: |
          curl --fail --silent --show-error --location \
            https://cdn.packages.unity.com/upm-cli/install.sh \
            --output "$RUNNER_TEMP/install-upm.sh"
          bash "$RUNNER_TEMP/install-upm.sh" v9.35.0
          echo "$HOME/.upm/bin" >> "$GITHUB_PATH"
          "$HOME/.upm/bin/upm" --version

      - name: Pack and sign UPM package
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
          UPM_SERVICE_ACCOUNT_KEY_ID: ${{ secrets.UPM_SERVICE_ACCOUNT_KEY_ID }}
          UPM_SERVICE_ACCOUNT_KEY_SECRET: ${{ secrets.UPM_SERVICE_ACCOUNT_KEY_SECRET }}
          UPM_ORG_ID: ${{ secrets.UPM_ORG_ID }}
        run: |
          bash .github/scripts/sign-upm.sh \
            Assets/MackySoft/MackySoft.SerializeReferenceExtensions \
            "$RUNNER_TEMP/signed-upm"

      - name: Upload signed UPM package
        uses: actions/upload-artifact@v7
        with:
          name: Signed-UPM
          path: ${{ runner.temp }}/signed-upm/*.tgz
          if-no-files-found: error

  build:
    needs: prepare
    runs-on: ubuntu-22.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.prepare.outputs.sha }}
          lfs: true

      - name: Set up Unity
        uses: ./.github/actions/setup-unity
        with:
          editor-version: 2021.3.45f2
          email: ${{ secrets.UNITY_EMAIL }}
          password: ${{ secrets.UNITY_PASSWORD }}

      - name: Build example player
        run: |
          unity --non-interactive build . \
            --editor-version 2021.3.45f2 \
            --target StandaloneLinux64 \
            --output-path Build/StandaloneLinux64/SerializeReferenceExtensions \
            --log-file Logs/build.log \
            --timeout 900
          tar -czf Build/StandaloneLinux64.tar.gz -C Build StandaloneLinux64

      - name: Export unitypackage
        env:
          RELEASE_ASSET_BASENAME: ${{ needs.prepare.outputs.asset_basename }}
        run: |
          unity --non-interactive run . \
            --editor-version 2021.3.45f2 \
            --log-file Logs/package.log \
            --timeout 900 \
            -- -nographics -executeMethod MackySoft.PackageTools.Editor.UnityPackageExporter.Export
          mv -- Build/SerializeReference-Extensions.unitypackage \
            "Build/$RELEASE_ASSET_BASENAME.unitypackage"

      - name: check all .meta is commited
        run: |
          if git ls-files --others --exclude-standard -t | grep --regexp='[.]meta$'; then
            echo "Detected .meta file generated. Do you forgot commit a .meta file?"
            exit 1
          else
            echo "Great, all .meta files are commited."
          fi
        working-directory: .

      - name: Return Unity license
        if: always() && env.UNITY_LICENSE_ACTIVATION_ATTEMPTED == 'true'
        timeout-minutes: 5
        env:
          UNITY_EDITOR_VERSION: 2021.3.45f2
          UNITY_EMAIL: ${{ secrets.UNITY_EMAIL }}
          UNITY_PASSWORD: ${{ secrets.UNITY_PASSWORD }}
        run: bash .github/actions/setup-unity/return-license.sh

      # Store artifacts.
      - name: Upload example player
        uses: actions/upload-artifact@v7
        with:
          name: StandaloneLinux64
          path: Build/StandaloneLinux64.tar.gz
          if-no-files-found: error

      - uses: actions/upload-artifact@v7
        with:
          name: ${{ needs.prepare.outputs.asset_basename }}.unitypackage
          path: ./Build/${{ needs.prepare.outputs.asset_basename }}.unitypackage
          if-no-files-found: error

      - name: Upload Unity logs
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: Release-Logs
          path: Logs/

  create-release:
    needs: [prepare, build, sign-upm]
    runs-on: ubuntu-24.04
    steps:
      # Each job owns a short-lived token; prepare's token is revoked before build.
      - name: Create release app token
        id: release_app
        uses: actions/create-github-app-token@v3
        with:
          client-id: ${{ vars.RELEASE_BOT_APP_ID }}
          private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
          permission-contents: write

      - uses: actions/checkout@v7
        with:
          ref: ${{ needs.prepare.outputs.sha }}
          token: ${{ steps.release_app.outputs.token }}

      # Publish the exact commit that produced the package. Recheck the remote
      # after the build, since another release may have created the tag meanwhile.
      - name: Create release tag
        env:
          VERSION: ${{ needs.prepare.outputs.version }}
          RELEASE_SHA: ${{ needs.prepare.outputs.sha }}
        run: bash .github/scripts/release.sh create

      # Download the package artifact for the release.
      - uses: actions/download-artifact@v8
        with:
          name: ${{ needs.prepare.outputs.asset_basename }}.unitypackage
          path: UnityPackage

      - uses: actions/download-artifact@v8
        with:
          name: Signed-UPM
          path: Signed-UPM

      # Keep the release draft until its notes are ready. Both packages must be
      # attached before publication makes the signed tarball visible to OpenUPM.
      - uses: softprops/action-gh-release@v3
        with:
          token: ${{ steps.release_app.outputs.token }}
          tag_name: ${{ needs.prepare.outputs.version }}
          name: ${{ needs.prepare.outputs.version }}
          target_commitish: ${{ needs.prepare.outputs.sha }}
          draft: true
          prerelease: false
          fail_on_unmatched_files: true
          files: |
            UnityPackage/${{ needs.prepare.outputs.asset_basename }}.unitypackage
            Signed-UPM/*.tgz

  publish-openupm:
    if: github.event_name == 'release'
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Publish signed release to OpenUPM
        id: openupm
        uses: openupm/openupm-action@v1
        with:
          package: com.mackysoft.serializereference-extensions
          tag: ${{ github.event.release.tag_name }}

      - name: Require a signed OpenUPM version
        env:
          SIGNED: ${{ steps.openupm.outputs.signed }}
        run: |
          if [[ "$SIGNED" != true ]]; then
            echo "::error::OpenUPM did not publish the signed package."
            exit 1
          fi