deploy.yml

name: Deploy to WordPress.org
on:
  push:
    tags:
    - "*"
jobs:
  tag:
    name: New tag
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
      attestations: write
    timeout-minutes: 70
    steps:
      - name: Checkout project
        uses: actions/checkout@v7
      - name: Setup Node
        uses: actions/setup-node@v7
        with:
          node-version: '24'
          cache: 'npm'
      - name: Composer dependencies
        run: composer install --no-dev --no-interaction --optimize-autoloader
      - name: Composer build
        run: composer run-script build
      # "composer build" leaves the ready-to-ship distribution in ./multisite-language-switcher
      # (bin/git-release.sh rsyncs the repository through .distignore). Everything after that
      # point - including the "composer update" that restores the require-dev packages for
      # local development - only touches the working tree, never the build directory.
      - name: Verify the build directory
        run: |
          BUILD_DIR=multisite-language-switcher
          test -d "$BUILD_DIR" || { echo "::error::$BUILD_DIR was not created by composer build"; exit 1; }
          for required in MultisiteLanguageSwitcher.php readme.txt vendor/autoload.php; do
            test -e "$BUILD_DIR/$required" || { echo "::error::$BUILD_DIR/$required is missing"; exit 1; }
          done
          for forbidden in .git .github docs src tests node_modules composer.lock package.json; do
            test ! -e "$BUILD_DIR/$forbidden" || { echo "::error::$BUILD_DIR/$forbidden must not be shipped"; exit 1; }
          done
          php -r '
            $lock  = json_decode(file_get_contents("composer.lock"), true);
            $found = [];
            foreach ($lock["packages-dev"] as $package) {
                if (is_dir("multisite-language-switcher/vendor/" . $package["name"])) {
                    $found[] = $package["name"];
                }
            }
            if ($found) {
                fwrite(STDERR, "::error::require-dev packages in the build directory: " . implode(", ", $found) . PHP_EOL);
                exit(1);
            }
          '
          echo "Build directory holds $(find "$BUILD_DIR" -type f | wc -l) files, production dependencies only."
      - name: WordPress Plugin Deploy
        uses: 10up/action-wordpress-plugin-deploy@stable
        id: deploy
        env:
          SVN_PASSWORD: ${{ secrets.SVN_PASSWORD }}
          SVN_USERNAME: ${{ secrets.SVN_USERNAME }}
          SLUG: multisite-language-switcher
          # Deploy only the built distribution. Without this the action falls back to
          # rsyncing the whole workspace through .distignore - which cannot exclude vendor/,
          # so the require-dev packages restored by "composer build" ended up in the SVN
          # transaction and broke the 3.0.0 release.
          BUILD_DIR: multisite-language-switcher
        with:
          generate-zip: true
      - name: Attest build provenance
        uses: johnbillion/action-wordpress-plugin-attestation@0.7.3
        with:
          zip-path: ${{ steps.deploy.outputs.zip-path }}