name: Release

# Merging (or pushing) into production releases whatever version the files
# declare: <Version> in src/CertifiEd.Client/CertifiEd.Client.csproj is the
# single source of truth. The workflow tags it, publishes the package to
# nuget.org and creates the Gitea release.
#
# To ship: bump <Version> on dev, merge dev -> production.
on:
  push:
    branches: [production]

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: "10.0.x"

      - name: Read version from the project file
        id: version
        run: |
          set -euo pipefail
          VERSION=$(sed -n 's:.*<Version>\(.*\)</Version>.*:\1:p' src/CertifiEd.Client/CertifiEd.Client.csproj | head -1)
          if [ -z "$VERSION" ]; then
            echo "::error::<Version> not found in src/CertifiEd.Client/CertifiEd.Client.csproj"
            exit 1
          fi
          echo "value=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Releasing version $VERSION"

      # A published NuGet version can never be replaced, so refuse to re-run an
      # already released version instead of silently doing nothing.
      - name: Refuse to release an existing version
        env:
          TOKEN: ${{ secrets.GITEA_TOKEN }}
        run: |
          set -euo pipefail
          TAG="v${{ steps.version.outputs.value }}"
          CODE=$(curl -s -o /dev/null -w '%{http_code}' \
            -H "Authorization: token $TOKEN" \
            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/tags/$TAG")
          if [ "$CODE" = "200" ]; then
            echo "::error::$TAG is already released. Bump <Version> in the csproj on dev, then merge again."
            exit 1
          fi

      - name: Build
        run: dotnet build --configuration Release

      - name: Pack
        run: >
          dotnet pack src/CertifiEd.Client/CertifiEd.Client.csproj
          --configuration Release --no-build --output artifacts

      # No --skip-duplicate: a duplicate must fail loudly, not look successful.
      - name: Publish to nuget.org
        env:
          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
        run: |
          set -euo pipefail
          if [ -z "${NUGET_API_KEY:-}" ]; then
            echo "::error::NUGET_API_KEY secret is not set"
            exit 1
          fi
          dotnet nuget push artifacts/*.nupkg \
            --source https://api.nuget.org/v3/index.json \
            --api-key "$NUGET_API_KEY"

      # Tag and release only after the package is actually on nuget.org, so the
      # tag always corresponds to something published.
      - name: Tag and create the release
        env:
          TOKEN: ${{ secrets.GITEA_TOKEN }}
        run: |
          set -euo pipefail
          VERSION="${{ steps.version.outputs.value }}"
          TAG="v$VERSION"
          BODY="CertifiEd.Client $VERSION\n\nnuget: https://www.nuget.org/packages/CertifiEd.Client/$VERSION"
          curl -sf -X POST \
            -H "Authorization: token $TOKEN" \
            -H "Content-Type: application/json" \
            -d "{\"tag_name\":\"$TAG\",\"target_commitish\":\"$GITHUB_SHA\",\"name\":\"$TAG\",\"body\":\"$BODY\"}" \
            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases" > /dev/null
          echo "Released $TAG"

      - name: Upload package artifacts
        uses: actions/upload-artifact@v3
        with:
          name: nupkg
          path: artifacts/*