name: Build installers and release

on:
  push:
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: read

# A retry for the same ref must not publish concurrently with its original run.
concurrency:
  group: manual-release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  build:
    uses: ./.github/workflows/ci.yml
  publish:
    if: startsWith(github.ref, 'refs/tags/v')
    needs: build
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.sha }}
          persist-credentials: false
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version-file: .nvmrc
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: installer-*
          path: release
          merge-multiple: true
          digest-mismatch: error
      - name: Validate release assets and create checksums
        run: node scripts/prepare-release-assets.mjs release "${GITHUB_REF_NAME#v}"
      - name: Publish the release
        working-directory: release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "${GITHUB_REF_NAME}" \
            ./*.exe ./*.dmg ./*.AppImage latest.yml latest-linux.yml SHA256SUMS.txt \
            --repo "${GITHUB_REPOSITORY}" --verify-tag \
            --title "${GITHUB_REF_NAME}" \
            --generate-notes