name: Release

on:
  release:
    types: [published]

permissions:
  contents: write

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: ${{ gitea.ref }}

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: Test
        run: make test

      - name: Build all artifacts (default + cloud, all platforms)
        env:
          VERSION: ${{ gitea.event.release.tag_name }}
          PRERELEASE: ${{ gitea.event.release.prerelease }}
        run: |
          make release VERSION="$VERSION" PRERELEASE="$PRERELEASE"
          make release-cloud VERSION="$VERSION" PRERELEASE="$PRERELEASE"

      # Shared between the upload and tap-publish jobs so neither has to
      # rebuild — lets a failed "Upload artifacts to release" run be
      # retried on its own without re-running the whole build.
      - name: Stash dist/ for downstream jobs
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/
          retention-days: 1

  upload-release:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Download dist/
        uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/

      - name: Upload artifacts to release
        env:
          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          api="${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/releases/${{ gitea.event.release.id }}/assets"
          for f in dist/*; do
            name="$(basename "$f")"
            echo "uploading $name"
            curl --fail -sS -X POST \
              -H "Authorization: token ${GITEA_TOKEN}" \
              -F "attachment=@${f};filename=${name}" \
              "${api}?name=${name}"
          done

  # Homebrew/Linuxbrew tap + Scoop bucket: only for stable releases — a
  # prerelease shouldn't become what `brew install`/`scoop install` resolve
  # to by default. See .gitea/scripts/publish-tap.sh.
  #
  # Runs independently of upload-release's outcome (needs it only for
  # ordering, not success) so a flaky asset upload doesn't block the tap
  # from getting published. publish-tap.sh is idempotent — it no-ops if
  # the tap is already at this version — so retrying upload-release later
  # won't re-trigger a duplicate tap push.
  publish-tap:
    needs: [build, upload-release]
    if: always() && needs.build.result == 'success' && gitea.event.release.prerelease != true
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Download dist/
        uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/

      - name: Publish Homebrew/Scoop tap
        env:
          VERSION: ${{ gitea.event.release.tag_name }}
          TAP_TOKEN: ${{ secrets.TAP_TOKEN }}
        run: .gitea/scripts/publish-tap.sh