name: Release

on:
  workflow_dispatch:
    inputs:
      bump:
        description: Version bump (auto uses conventional commits)
        type: choice
        default: auto
        options:
          - auto
          - major
          - minor
          - patch

concurrency:
  group: release
  cancel-in-progress: false

permissions:
  contents: read

defaults:
  run:
    shell: bash

jobs:
  prepare:
    name: Prepare release
    runs-on: depot-ubuntu-latest
    outputs:
      tag: ${{ steps.version.outputs.tag }}
      commit: ${{ steps.commit.outputs.commit }}

    steps:
      - name: Require the main branch
        run: |
          if [[ "$GITHUB_REF" != refs/heads/main ]]; then
            echo "::error::Releases must be triggered from main."
            exit 1
          fi

      - name: Checkout release source
        uses: actions/checkout@v6
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0
          persist-credentials: false

      - name: Setup git-cliff
        uses: taiki-e/install-action@v2
        with:
          tool: git-cliff@2.14.2

      - name: Calculate next version
        id: version
        env:
          BUMP: ${{ inputs.bump }}
        run: |
          version=$(git cliff --bumped-version --unreleased --offline --bump "$BUMP")
          version=${version#v}
          if [[ "$version" == "$(cat .version)" ]]; then
            echo "No commits requiring a version bump; no release created." >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi

          echo "version=$version" >> "$GITHUB_OUTPUT"
          echo "tag=v$version" >> "$GITHUB_OUTPUT"
          echo "Preparing release v$version from $GITHUB_SHA." >> "$GITHUB_STEP_SUMMARY"

      - name: Setup pnpm
        if: steps.version.outputs.tag != ''
        uses: pnpm/action-setup@v6
        with:
          run_install: false

      - name: Setup Node.js
        if: steps.version.outputs.tag != ''
        uses: actions/setup-node@v6.5.0
        with:
          node-version: 24
          cache: pnpm

      - name: Install dependencies
        if: steps.version.outputs.tag != ''
        run: pnpm install --frozen-lockfile

      - name: Update version and changelog
        if: steps.version.outputs.tag != ''
        env:
          VERSION: ${{ steps.version.outputs.version }}
          RELEASE_TAG: ${{ steps.version.outputs.tag }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          printf '%s\n' "$VERSION" > .version
          jq --arg version "$VERSION" '.version = $version' frontend/package.json > "$RUNNER_TEMP/package.json"
          mv "$RUNNER_TEMP/package.json" frontend/package.json
          pnpm --dir frontend exec prettier --write package.json
          git cliff --prepend CHANGELOG.md --tag "$RELEASE_TAG" --unreleased

      - name: Create bot app token
        if: steps.version.outputs.tag != ''
        id: app-token
        uses: actions/create-github-app-token@v3
        with:
          client-id: ${{ vars.BOT_APP_CLIENT_ID }}
          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
          permission-contents: write

      - name: Commit and tag release
        if: steps.version.outputs.tag != ''
        id: commit
        env:
          VERSION: ${{ steps.version.outputs.version }}
          RELEASE_TAG: ${{ steps.version.outputs.tag }}
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
        run: |
          # Attribute the release commit to the app and authenticate the push with its installation token
          bot_name="$APP_SLUG[bot]"
          bot_id=$(gh api "users/$bot_name" --jq .id)
          git config user.name "Pocket ID Bot"
          git config user.email "$bot_id+$bot_name@users.noreply.github.com"
          gh auth setup-git

          git add .version frontend/package.json CHANGELOG.md
          git commit -m "release: $VERSION"
          git tag "$RELEASE_TAG"

          # Publish both refs together so a concurrent main update cannot leave an orphaned release tag
          git push --atomic origin HEAD:refs/heads/main "refs/tags/$RELEASE_TAG"
          echo "commit=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

  build:
    name: Build and attest
    needs: prepare
    if: needs.prepare.outputs.tag != ''
    runs-on: depot-ubuntu-24.04-16
    permissions:
      contents: write
      packages: write
      id-token: write
      attestations: write
      artifact-metadata: write
    env:
      RELEASE_TAG: ${{ needs.prepare.outputs.tag }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.prepare.outputs.commit }}
          fetch-depth: 0

      - name: Create bot app token
        id: app-token
        uses: actions/create-github-app-token@v3
        with:
          client-id: ${{ vars.BOT_APP_CLIENT_ID }}
          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
          permission-contents: write

      - name: Create draft release
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          # Reuse the draft when retrying a failed build
          if is_draft=$(gh release view "$RELEASE_TAG" --json isDraft --jq .isDraft); then
            if [[ "$is_draft" != true ]]; then
              echo "::error::Release $RELEASE_TAG is already published."
              exit 1
            fi
          else
            awk '/^## v[0-9]/ { if (found) exit; found=1; next } found' CHANGELOG.md > "$RUNNER_TEMP/release-notes.md"
            gh release create "$RELEASE_TAG" --verify-tag --title "$RELEASE_TAG" --notes-file "$RUNNER_TEMP/release-notes.md" --draft
          fi

      - name: Setup pnpm
        uses: pnpm/action-setup@v6
        with:
          run_install: false

      - name: Setup Node.js
        uses: actions/setup-node@v6.5.0
        with:
          node-version: 24
          cache: pnpm

      - name: Setup Go
        uses: actions/setup-go@v6
        with:
          go-version-file: backend/go.mod
          cache-dependency-path: backend/go.sum

      - name: Setup Syft
        uses: anchore/sbom-action/download-syft@v0.24.2
        with:
          syft-version: v1.52.0

      - name: Set up Depot CLI
        uses: depot/setup-action@v1

      - name: Setup depot buildx driver
        run: depot configure-docker

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to Docker Hub
        uses: docker/login-action@v4.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v7.2.3
        with:
          distribution: goreleaser-pro
          version: "~> v2"
          args: release --clean --skip=validate --parallelism=4
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
          MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
          MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
          MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
          MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
          MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
          DISCORD_WEBHOOK_ID: ${{ secrets.DISCORD_WEBHOOK_ID }}
          DISCORD_WEBHOOK_TOKEN: ${{ secrets.DISCORD_WEBHOOK_TOKEN }}

      - name: Binary attestation
        uses: actions/attest@v4.2.2
        with:
          subject-checksums: ./dist/checksums.txt

      - name: Container image attestation
        uses: actions/attest@v4.2.2
        with:
          subject-checksums: ./dist/digests.txt

  publish:
    name: Publish release
    needs: [prepare, build]
    runs-on: depot-ubuntu-latest

    steps:
      - name: Create bot app token
        id: app-token
        uses: actions/create-github-app-token@v3
        with:
          client-id: ${{ vars.BOT_APP_CLIENT_ID }}
          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
          permission-contents: write

      - name: Publish release
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          GH_REPO: ${{ github.repository }}
          RELEASE_TAG: ${{ needs.prepare.outputs.tag }}
        run: |
          gh release edit "$RELEASE_TAG" --draft=false
          echo "Published [$RELEASE_TAG](https://github.com/$GH_REPO/releases/tag/$RELEASE_TAG)." >> "$GITHUB_STEP_SUMMARY"