kilocode/.github/workflows/publish-jetbrains.yml

# kilocode_change - new file
name: publish-jetbrains

on:
  pull_request:
    types:
      - closed
    branches:
      - main
  workflow_dispatch:
    inputs:
      pr:
        description: Merged JetBrains release PR number to publish
        required: true
        type: string
      merge_commit:
        description: Merge commit SHA from the reviewed release PR
        required: true
        type: string

concurrency:
  group: publish-jetbrains-pr-${{ github.event.pull_request.number || inputs.pr }}
  cancel-in-progress: false

permissions:
  contents: write
  pull-requests: read

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  publish:
    if: >-
      github.repository == 'Kilo-Org/kilocode' &&
      (
        (
          github.event_name == 'pull_request' &&
          github.event.pull_request.merged == true &&
          startsWith(github.event.pull_request.head.ref, 'jetbrains/release/') &&
          contains(github.event.pull_request.labels.*.name, 'jetbrains-release') &&
          github.event.pull_request.head.repo.full_name == github.repository
        ) ||
        github.event_name == 'workflow_dispatch'
      )
    runs-on: blacksmith-8vcpu-ubuntu-2404
    steps:
      - name: Checkout merged release PR
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.merge_commit_sha || inputs.merge_commit }}

      - name: Setup Bun for validation
        uses: ./.github/actions/setup-bun

      - name: Validate release PR and tag
        id: release
        run: bun script/jetbrains-release-validate.ts --pr "$PR_NUMBER"
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr }}

      - name: Save reviewed release metadata
        run: |
          cp packages/kilo-jetbrains/CHANGELOG.md "$RUNNER_TEMP/jetbrains-CHANGELOG.md"
          cp packages/kilo-jetbrains/gradle.properties "$RUNNER_TEMP/jetbrains-gradle.properties"

      - name: Checkout release tag
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          ref: ${{ steps.release.outputs.tag }}

      - name: Restore reviewed release metadata
        run: |
          cp "$RUNNER_TEMP/jetbrains-CHANGELOG.md" packages/kilo-jetbrains/CHANGELOG.md
          cp "$RUNNER_TEMP/jetbrains-gradle.properties" packages/kilo-jetbrains/gradle.properties

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "24"

      - name: Setup Bun
        uses: ./.github/actions/setup-bun

      - name: Install dependencies
        run: bun install

      - name: Setup Java
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "21"

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v4

      - name: Install build tools
        run: |
          sudo apt-get update
          sudo apt-get install -y patchelf zip
          curl --fail --location \
            https://ziglang.org/download/0.14.0/zig-linux-x86_64-0.14.0.tar.xz \
            --output "$RUNNER_TEMP/zig.tar.xz"
          echo "473ec26806133cf4d1918caf1a410f8403a13d979726a9045b421b685031a982  $RUNNER_TEMP/zig.tar.xz" | sha256sum --check --status
          tar -xJf "$RUNNER_TEMP/zig.tar.xz" -C "$RUNNER_TEMP"
          echo "$RUNNER_TEMP/zig-linux-x86_64-0.14.0" >> "$GITHUB_PATH"

      - name: Validate publishing secrets
        run: |
          missing=0
          for name in JETBRAINS_MARKETPLACE_TOKEN JETBRAINS_CERTIFICATE_CHAIN JETBRAINS_PRIVATE_KEY JETBRAINS_PRIVATE_KEY_PASSWORD; do
            if [[ -z "${!name}" ]]; then
              echo "Missing required secret: $name" >&2
              missing=1
            fi
          done
          exit "$missing"
        env:
          JETBRAINS_MARKETPLACE_TOKEN: ${{ secrets.JETBRAINS_MARKETPLACE_TOKEN }}
          JETBRAINS_CERTIFICATE_CHAIN: ${{ secrets.JETBRAINS_CERTIFICATE_CHAIN }}
          JETBRAINS_PRIVATE_KEY: ${{ secrets.JETBRAINS_PRIVATE_KEY }}
          JETBRAINS_PRIVATE_KEY_PASSWORD: ${{ secrets.JETBRAINS_PRIVATE_KEY_PASSWORD }}

      - name: Verify plugin
        working-directory: packages/kilo-jetbrains
        run: ./gradlew verifyPlugin -Pproduction=true -Pkilo.channel="$CHANNEL"
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ steps.release.outputs.version }}
          CHANNEL: ${{ steps.release.outputs.marketplace_channel }}

      - name: Render release notes
        working-directory: packages/kilo-jetbrains
        run: |
          if ! grep -Fq "## [$VERSION]" CHANGELOG.md; then
            echo "Missing packages/kilo-jetbrains/CHANGELOG.md entry for $VERSION. Review and merge a release PR before publishing." >&2
            exit 1
          fi
          ./gradlew getChangelog --project-version "$VERSION" --no-header --no-empty-sections --output-file=build/release-notes.md
        env:
          VERSION: ${{ steps.release.outputs.version }}

      - name: Publish to JetBrains Marketplace
        working-directory: packages/kilo-jetbrains
        run: ./gradlew publishPlugin -Pproduction=true -Pkilo.channel="$CHANNEL"
        env:
          VERSION: ${{ steps.release.outputs.version }}
          CHANNEL: ${{ steps.release.outputs.marketplace_channel }}
          JETBRAINS_MARKETPLACE_TOKEN: ${{ secrets.JETBRAINS_MARKETPLACE_TOKEN }}
          JETBRAINS_CERTIFICATE_CHAIN: ${{ secrets.JETBRAINS_CERTIFICATE_CHAIN }}
          JETBRAINS_PRIVATE_KEY: ${{ secrets.JETBRAINS_PRIVATE_KEY }}
          JETBRAINS_PRIVATE_KEY_PASSWORD: ${{ secrets.JETBRAINS_PRIVATE_KEY_PASSWORD }}

      - name: Resolve plugin archive
        id: archive
        run: |
          mapfile -t signed < <(compgen -G "packages/kilo-jetbrains/build/distributions/*-signed.zip")
          if [[ "${#signed[@]}" -eq 1 ]]; then
            echo "path=${signed[0]}" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          if [[ "${#signed[@]}" -gt 1 ]]; then
            echo "Expected exactly one signed JetBrains plugin ZIP, found ${#signed[@]}." >&2
            printf '%s\n' "${signed[@]}" >&2
            exit 1
          fi

          mapfile -t files < <(compgen -G "packages/kilo-jetbrains/build/distributions/*.zip")
          if [[ "${#files[@]}" -ne 1 ]]; then
            echo "Expected exactly one JetBrains plugin ZIP, found ${#files[@]}." >&2
            printf '%s\n' "${files[@]}" >&2
            exit 1
          fi
          echo "path=${files[0]}" >> "$GITHUB_OUTPUT"

      - name: Upload to GitHub Release
        run: |
          tag="$TAG"
          title="JetBrains $VERSION"
          flags=(--title "$title" --notes-file "$NOTES")
          if [[ "$KIND" == "rc" ]]; then
            flags+=(--prerelease)
          fi
          if gh release view "$tag" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
            gh release upload "$tag" "$ARCHIVE" --clobber --repo "$GITHUB_REPOSITORY"
            gh release edit "$tag" "${flags[@]}" --repo "$GITHUB_REPOSITORY"
            exit 0
          fi
          gh release create "$tag" "$ARCHIVE" "${flags[@]}" --repo "$GITHUB_REPOSITORY"
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ steps.release.outputs.tag }}
          VERSION: ${{ steps.release.outputs.version }}
          KIND: ${{ steps.release.outputs.kind }}
          ARCHIVE: ${{ steps.archive.outputs.path }}
          NOTES: packages/kilo-jetbrains/build/release-notes.md

      - name: Upload workflow artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: kilo-jetbrains-${{ steps.release.outputs.version }}
          path: packages/kilo-jetbrains/build/distributions/*.zip
          if-no-files-found: ignore