# Cuts the signed PGXN distribution and publishes it as a GitHub release on
# version tags (v<major>.<minor>.<patch>), or for an existing tag on manual
# dispatch. Secret: PGMORBAC_RELEASE_KEY, the Ed25519 private key PEM (content,
# not a path). The organisation only allows its own actions, so checkout and
# Node setup are plain shell: git over the job token, and the official Node
# tarball checked against its published SHA-256.
name: release

on:
  push:
    tags: ['v*']
  workflow_dispatch:
    inputs:
      tag:
        description: Existing version tag to release (e.g. v1.0.1)
        required: true

permissions:
  contents: write

jobs:
  release:
    runs-on: ubuntu-latest
    env:
      NODE_VERSION: v24.22.2
      RELEASE_REF: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref_name }}
    steps:
      - name: Check out the tag
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          case "$RELEASE_REF" in v[0-9]*.[0-9]*.[0-9]*) ;; *) echo "not a version tag: $RELEASE_REF" >&2; exit 1 ;; esac
          git init -q .
          basic=$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 -w0)
          git -c http.extraheader="AUTHORIZATION: basic $basic" fetch -q --depth 1 \
            "https://github.com/$GITHUB_REPOSITORY" "refs/tags/$RELEASE_REF:refs/tags/$RELEASE_REF"
          git checkout -q "refs/tags/$RELEASE_REF"
      - name: Install Node
        run: |
          base="https://nodejs.org/dist/$NODE_VERSION"
          file="node-$NODE_VERSION-linux-x64.tar.xz"
          curl -fsSLO "$base/$file"
          curl -fsSL "$base/SHASUMS256.txt" | grep " $file\$" | sha256sum -c -
          mkdir -p "$RUNNER_TEMP/node"
          tar -xJf "$file" -C "$RUNNER_TEMP/node" --strip-components=1
          rm "$file"
          echo "$RUNNER_TEMP/node/bin" >> "$GITHUB_PATH"
      - run: npm install --no-audit --no-fund
      - name: Build and sign
        env:
          PGMORBAC_RELEASE_KEY_PEM: ${{ secrets.PGMORBAC_RELEASE_KEY }}
        run: |
          umask 077
          printf '%s\n' "$PGMORBAC_RELEASE_KEY_PEM" > "$RUNNER_TEMP/release-key.pem"
          PGMORBAC_RELEASE_KEY="$RUNNER_TEMP/release-key.pem" node scripts/build-dist.mjs
      - name: Publish
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: node scripts/github-release.mjs