name: Auto release

# Eligible pushes to main build the next patch from that commit, then tag and
# publishes it after all installer jobs pass. Minor and major releases stay manual.
on:
  push:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: auto-release
  cancel-in-progress: false

jobs:
  version:
    # Skip only the release lane; ordinary CI still validates this commit.
    if: "!startsWith(github.event.head_commit.message, 'Release ') && !contains(github.event.head_commit.message, '[skip release]')"
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          ref: ${{ github.sha }}
          persist-credentials: false
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version-file: .nvmrc
      - id: version
        run: |
          VERSION="$(node scripts/release-version.mjs)"
          echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"

  build:
    needs: version
    uses: ./.github/workflows/ci.yml
    with:
      ref: ${{ github.sha }}
      release_version: ${{ needs.version.outputs.version }}

  publish:
    needs: [version, build]
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: installer-*
          path: release
          merge-multiple: true
          digest-mismatch: error
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version-file: .nvmrc
      - name: Validate release assets and create checksums
        env:
          RELEASE_VERSION: ${{ needs.version.outputs.version }}
        run: node scripts/prepare-release-assets.mjs release "${RELEASE_VERSION}"
      - name: Create the release tag
        env:
          RELEASE_VERSION: ${{ needs.version.outputs.version }}
        run: |
          TAG="v${RELEASE_VERSION}"
          if git show-ref --verify --quiet "refs/tags/${TAG}"; then
            test "$(git rev-parse "${TAG}^{commit}")" = "${GITHUB_SHA}"
          else
            git tag "${TAG}" "${GITHUB_SHA}"
            git push origin "refs/tags/${TAG}"
          fi
      - name: Publish the release
        working-directory: release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "v${{ needs.version.outputs.version }}" \
            ./*.exe ./*.dmg ./*.AppImage latest.yml latest-linux.yml SHA256SUMS.txt \
            --repo "${GITHUB_REPOSITORY}" --verify-tag \
            --title "v${{ needs.version.outputs.version }}" \
            --generate-notes