Release process GH Action

.github/workflows/ci.yml

@@ -2,6 +2,8 @@ name: CI
 
 on:
   push:
+    branches: [ develop, master ]
+  workflow_call:
   pull_request:
 
 jobs:

.github/workflows/deploy-to-wp-org.yml

@@ -0,0 +1,113 @@
+name: Deploy to WordPress.org Repository
+
+on:
+
+  # The action will run when a release or a pre-release is created.
+  #
+  # In case of a pre-release, the action will not commit to WP.org (dry-run). However, it will still
+  # create a zip file and upload it to the release. Note that a pre-release (release candidate)
+  # should not be changed to a release but rather a new release should be created.
+  #
+  # The "prereleased" type will not trigger for pre-releases published from draft releases, but
+  # the "published" type will trigger. Since we want a workflow to run when stable and pre-releases
+  # publish, we subscribe to "published" instead of "released" and "prereleased".
+  #
+  # See: https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#release
+  release:
+    types: [ published ]
+
+  # Allows running the workflow manually (e.g. against a branch or tag) without publishing a
+  # real GitHub release, so the pipeline can be exercised safely. Defaults to a dry-run.
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Skip the actual WP.org SVN commit (still builds, verifies, and uploads a zip artifact)'
+        type: boolean
+        default: true
+
+jobs:
+  lint_and_test:
+    uses: ./.github/workflows/ci.yml
+    secrets: inherit
+
+  deploy_to_wp_repository:
+    needs: lint_and_test
+    name: Deploy to WP.org
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+          tools: composer:v2
+
+      - name: Get Composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache Composer packages
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: ${{ runner.os }}-php-${{ hashFiles( 'composer.lock' ) }}
+          restore-keys: ${{ runner.os }}-php-
+
+      # Install dependencies.
+      - name: Install NPM dependencies
+        run: npm ci
+
+      - name: Install Composer dependencies
+        run: composer install --no-dev
+
+      # Build.
+      - name: Build
+        run: npm run build
+
+      - name: Prepare build directory
+        run: npx grunt prepare
+
+      # Ensure the version in the .version file matches the tag of the release.
+      # Skipped for manual runs, which may not be run against a release tag.
+      - name: Verify version matches tag
+        if: github.event_name == 'release'
+        run: |
+          TAG="${GITHUB_REF_NAME#v}"
+          FILE_VERSION=$(cat .version | tr -d '[:space:]')
+          if [ "$TAG" != "$FILE_VERSION" ]; then
+            echo "::error::Tag $TAG does not match .version $FILE_VERSION"
+            exit 1
+          fi
+
+      - name: WordPress Plugin Deploy
+        # This is used to get the zip-path later.
+        id: deploy
+        uses: 10up/action-wordpress-plugin-deploy@stable
+        with:
+          generate-zip: true
+          # In case of a pre-release, do not commit to WP.org. Manual runs default to a dry-run too.
+          dry-run: ${{ github.event_name == 'release' && github.event.release.prerelease || inputs.dry_run }}
+
+        env:
+          BUILD_DIR: 'build'
+          SLUG: 'cloudinary-image-management-and-manipulation-in-the-cloud-cdn'
+          # Use secrets to authenticate with WP.org.
+          SVN_USERNAME: ${{ secrets.SVN_USERNAME }}
+          SVN_PASSWORD: ${{ secrets.SVN_PASSWORD }}
+
+      - name: Upload release asset
+        if: github.event_name == 'release'
+        uses: softprops/action-gh-release@v2
+        with:
+          files: ${{ steps.deploy.outputs.zip-path }}

README.md

@@ -111,11 +111,18 @@ Files included in the release package are defined in the `gruntfile.js` under th
 
 ### Deployment to WordPress.org
 
-1. Tag a release from the `master` branch on GitHub.
+Deployment is automated via the `Deploy to WordPress.org Repository` GitHub Actions workflow (`.github/workflows/deploy-to-wp-org.yml`):
 
-2. Run `npm run deploy` to deploy the version referenced in the `cloudinary.php` file of the current branch.
+1. Bump the version in `.version` on `master` (this is what gets checked against the release tag, and what `readme.txt`/`cloudinary.php` are stamped with during the build).
 
-3. Run `npm run deploy-assets` to deploy just the WP.org plugin assets such as screenshots, icons and banners.
+2. Create and publish a GitHub Release from `master`, with a tag matching that version (e.g. `3.3.4` or `v3.3.4`). Publishing the release triggers the workflow, which builds the plugin, deploys it to the WP.org SVN repository, and attaches the built zip to the release.
+
+   - Marking the release as a **pre-release** runs the same workflow in dry-run mode: it builds and verifies everything but skips the actual SVN commit, which is the safe way to test a release without shipping it to WP.org.
+   - The workflow can also be run manually from the Actions tab (`workflow_dispatch`) against any branch/tag, defaulting to a dry-run, to exercise the pipeline without publishing a GitHub release at all.
+
+3. If you need to deploy from a local machine instead (e.g. as a fallback), run `npm run deploy`, which builds and runs `grunt deploy` using SVN credentials configured locally.
+
+4. Run `npm run deploy-assets` to deploy just the WP.org plugin assets such as screenshots, icons and banners.
 
 ## End-to-end testing