markdownlint-rs 0.3.21

A fast, flexible, configuration-based command-line interface for linting Markdown/CommonMark files
Documentation
name: Tag and Release

on:
  push:
    tags:
      - "v*.*.*"

# Prevent concurrent builds: only one at a time (main pushes + releases)
concurrency:
  group: main-build
  cancel-in-progress: false

jobs:
  lint:
    permissions:
      contents: read
    name: Lint and test
    uses: ./.github/workflows/ci.yml

  draft-release:
    name: Create draft release
    runs-on: ubuntu-latest
    needs: lint
    permissions:
      contents: write
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

      - name: Get tag version
        id: version
        run: echo "version=${GITHUB_REF#refs/tags/v}" | tee -a "$GITHUB_OUTPUT"

      - name: Verify all package versions match tag
        env:
          TAG_VERSION: ${{ steps.version.outputs.version }}
        run: |
          CARGO_VERSION="$(yq -roy '.package.version' Cargo.toml)"
          NPM_VERSION="$(jq -r '.version' npm/package.json)"
          PYTHON_VERSION="$(yq -roy '.project.version' python/pyproject.toml)"

          FAILED=0
          for PAIR in "Cargo.toml:${CARGO_VERSION}" "npm/package.json:${NPM_VERSION}" "python/pyproject.toml:${PYTHON_VERSION}"; do
            FILE="${PAIR%%:*}"
            VERSION="${PAIR##*:}"
            if [[ "$TAG_VERSION" != "$VERSION" ]]; then
              echo "Tag version ${TAG_VERSION} does not match ${FILE} version ${VERSION}" >&2
              FAILED=1
            fi
          done
          exit "$FAILED"

      - name: Check if release already exists
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          if gh release view '${{ github.ref_name }}' --repo '${{ github.repository }}'; then
            echo "Release ${{ github.ref_name }} already exists" >&2
            exit 1
          fi

      - name: Create Draft Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VERSION: ${{ steps.version.outputs.version }}
          REPO: ${{ github.repository }}
        run: |
          # shellcheck disable=SC2016
          envsubst '$VERSION $REPO' < .github/release-template.md > /tmp/release-notes.md
          gh release create '${{ github.ref_name }}' \
            --repo '${{ github.repository }}' \
            --title "Release ${{ github.ref_name }}" \
            --draft \
            --notes-file /tmp/release-notes.md

  ####
  # Publish binaries to GitHub; necessary for Python and Node builds
  ####

  release-binaries:
    name: Release Binaries
    needs: draft-release
    permissions:
      contents: write
    uses: ./.github/workflows/release-binaries.yml
    with:
      release: ${{ github.ref_name }}

  ####
  # Publish to consumer repositories
  ####

  publish-docker:
    needs: release-binaries
    permissions:
      contents: read
      packages: write
    uses: ./.github/workflows/publish-container.yml
    with:
      version: ${{ github.ref_name }}
    secrets: inherit

  publish-node:
    needs: release-binaries
    permissions:
      contents: read
      id-token: write # OIDC trusted publishing
    uses: ./.github/workflows/publish-npm.yml

  publish-python:
    needs: release-binaries
    permissions:
      contents: read
      id-token: write # OIDC trusted publishing
    uses: ./.github/workflows/publish-python.yml

  publish-rust:
    needs: release-binaries
    permissions:
      contents: read
      id-token: write # OIDC trusted publishing
    uses: ./.github/workflows/publish-rust.yml

  ####
  # Finalize the draft release
  ####

  publish-release:
    name: Publish Release
    needs:
      - publish-docker
      - publish-node
      - publish-python
      - publish-rust
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

      - name: Publish Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh release edit '${{ github.ref_name }}' --repo '${{ github.repository }}' --draft=false