name: Publish and Release

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      tag:
        description: Existing git tag to publish and release (for example: v0.2.18)
        required: true
        type: string

jobs:
  verify:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      tag: ${{ steps.meta.outputs.tag }}
      version: ${{ steps.meta.outputs.version }}
    steps:
      - name: Resolve release metadata
        id: meta
        shell: bash
        env:
          INPUT_TAG: ${{ github.event.inputs.tag }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          TAG="${INPUT_TAG:-$REF_NAME}"
          VERSION="${TAG#v}"
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
      - uses: actions/checkout@v6
        with:
          ref: refs/tags/${{ steps.meta.outputs.tag }}
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          registry-url: "https://registry.npmjs.org"
      - run: npm ci
      - name: Verify package version matches tag
        shell: bash
        run: |
          ACTUAL="$(node -p "require('./package.json').version")"
          EXPECTED="${{ steps.meta.outputs.version }}"
          test "$ACTUAL" = "$EXPECTED"
      - run: npm test
      - run: npm pack

  publish-npm:
    needs: verify
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v6
        with:
          ref: refs/tags/${{ needs.verify.outputs.tag }}
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          registry-url: "https://registry.npmjs.org"
      - run: npm ci
      - run: npm publish --provenance --access public

  build-native-bundles:
    needs: verify
    strategy:
      fail-fast: false
      matrix:
        include:
          - id: linux-x64
            os: ubuntu-latest
          - id: darwin-x64
            os: macos-15-intel
          - id: darwin-arm64
            os: macos-14
          - id: win32-x64
            os: windows-latest
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6
        with:
          ref: refs/tags/${{ needs.verify.outputs.tag }}
      - uses: actions/setup-node@v6
        with:
          node-version: 24
      - run: npm ci --ignore-scripts
      - run: npm run build
      - run: npm run build:native-bundle
      - name: Smoke native bundle (Unix)
        if: matrix.id != 'win32-x64'
        shell: bash
        run: |
          VERSION=$(node -p "require('./package.json').version")
          tmp=$(mktemp -d)
          tar -xzf "dist/release/feynman-${VERSION}-${{ matrix.id }}.tar.gz" -C "$tmp"
          "$tmp/feynman-${VERSION}-${{ matrix.id }}/feynman" --help >/tmp/feynman-help.out
          head -20 /tmp/feynman-help.out
      - name: Smoke native bundle (Windows)
        if: matrix.id == 'win32-x64'
        shell: pwsh
        run: |
          $version = node -p "require('./package.json').version"
          $tmp = Join-Path $env:RUNNER_TEMP ("feynman-smoke-" + [guid]::NewGuid().ToString("N"))
          New-Item -ItemType Directory -Path $tmp | Out-Null
          Expand-Archive -LiteralPath "dist/release/feynman-$version-win32-x64.zip" -DestinationPath $tmp -Force
          $bundleRoot = Join-Path $tmp "feynman-$version-win32-x64"
          & (Join-Path $bundleRoot "feynman.cmd") --help | Select-Object -First 20
      - uses: actions/upload-artifact@v4
        with:
          name: native-${{ matrix.id }}
          path: dist/release/*

  release-github:
    needs:
      - publish-npm
      - build-native-bundles
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: release-assets
          merge-multiple: true
      - name: Create GitHub release
        shell: bash
        env:
          GH_REPO: ${{ github.repository }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          TAG: ${{ needs.verify.outputs.tag }}
        run: |
          if gh release view "$TAG" >/dev/null 2>&1; then
            gh release upload "$TAG" release-assets/* --clobber
            gh release edit "$TAG" \
              --title "$TAG" \
              --notes "Standalone Feynman bundles for native installation." \
              --draft=false \
              --latest
          else
            gh release create "$TAG" release-assets/* \
              --title "$TAG" \
              --notes "Standalone Feynman bundles for native installation."
          fi