name: release
on:
  push:
    tags:
      - 'v*.*.*'

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          version: 10
      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: pnpm
      - name: Verify tag matches package.json
        run: |
          TAG="${GITHUB_REF#refs/tags/v}"
          PKG=$(node -p 'require("./package.json").version')
          [ "$TAG" = "$PKG" ] || { echo "Tag v$TAG != package.json $PKG"; exit 1; }
      - run: |
          cat > .npmrc <<EOF
          @tsuki:registry=https://git.d-v.cc/api/packages/tsuki/npm/
          //git.d-v.cc/api/packages/tsuki/npm/:_authToken=${{ secrets.NPM_TOKEN }}
          EOF
      - run: pnpm install --frozen-lockfile
      - run: pnpm build
      - name: updates.json must be committed for this version
        run: git diff --exit-code updates.json
      - run: pnpm test
      - run: pnpm lint
      # Release Firefox only installs Mozilla-signed add-ons. The unlisted
      # channel signs without publishing on addons.mozilla.org.
      - name: Sign (AMO unlisted)
        env:
          WEB_EXT_API_KEY: ${{ secrets.AMO_JWT_ISSUER }}
          WEB_EXT_API_SECRET: ${{ secrets.AMO_JWT_SECRET }}
        run: pnpm sign
      - name: Bundle userChrome layer
        run: |
          VERSION="${GITHUB_REF#refs/tags/v}"
          (cd dist && zip -r "../web-ext-artifacts/tsuki-userchrome-$VERSION.zip" userChrome)
      - name: Create Gitea release with assets
        env:
          TOKEN: ${{ secrets.RELEASE_TOKEN }}
        run: |
          VERSION="${GITHUB_REF#refs/tags/v}"
          API="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
          ID=$(curl -fsS -X POST "$API/releases" \
            -H "Authorization: token $TOKEN" -H 'Content-Type: application/json' \
            -d "{\"tag_name\":\"v$VERSION\",\"name\":\"tsuki $VERSION\"}" | node -p 'JSON.parse(require("fs").readFileSync(0)).id')
          XPI=$(ls web-ext-artifacts/*.xpi | head -1)
          curl -fsS -X POST "$API/releases/$ID/assets?name=tsuki-$VERSION.xpi" \
            -H "Authorization: token $TOKEN" -F "attachment=@$XPI"
          curl -fsS -X POST "$API/releases/$ID/assets?name=tsuki-userchrome-$VERSION.zip" \
            -H "Authorization: token $TOKEN" -F "attachment=@web-ext-artifacts/tsuki-userchrome-$VERSION.zip"