release.yml

# Publish a GitHub Release with the plugin ZIP when a v* tag is pushed.
# Third-party actions are pinned to full commit SHAs (mutable tags are not used).
name: Release

on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false

      - name: Set up JDK 21
        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
        with:
          java-version: "21"
          distribution: temurin

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@48b5f213c81028ace310571dc5ec0fbbca0b2947 # v4

      - name: Grant execute permissions
        run: chmod +x ./gradlew

      - name: Validate tag matches pluginVersion
        run: |
          set -euo pipefail
          TAG="${GITHUB_REF_NAME#v}"
          VER="$(grep -E '^pluginVersion=' gradle.properties | cut -d= -f2- | tr -d '[:space:]')"
          echo "tag=$TAG pluginVersion=$VER"
          if [ "$TAG" != "$VER" ]; then
            echo "::error::Git tag v$TAG must match pluginVersion=$VER in gradle.properties"
            exit 1
          fi

      - name: Build plugin
        run: ./gradlew check verifyPlugin buildPlugin --stacktrace

      - name: Create GitHub Release
        # softprops/action-gh-release v2.6.2
        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65
        with:
          files: build/distributions/*.zip
          generate_release_notes: true
          fail_on_unmatched_files: true