release.yml

name: Release

on:
  push:
    tags: ['v*.*.*']

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: read
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
          node-version-file: '.node-version'
          cache: 'npm'
          registry-url: 'https://npm.pkg.github.com'
      # Skip post-install scripts here, as a malicious script could steal NODE_AUTH_TOKEN.
      - run: npm ci --ignore-scripts
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - run: npx patch-package
      - run: npm run verify
      - run: npm run build
      - id: release-xpi
        name: Release xpi
        uses: softprops/action-gh-release@v1
        with:
          files: xpi/*.xpi
          generate_release_notes: true
      - name: Generate update manifest
        run: npm run generateUpdateManifest -- ${{ fromJSON(steps.release-xpi.outputs.assets)[0].browser_download_url }}
      - name: Publish update manifest
        uses: softprops/action-gh-release@v1
        with:
          tag_name: release
          files: gen/update*