name: Release Obsidian Plugin

on:
  push:
    tags:
      - "[0-9]*"
  workflow_call:
    inputs:
      tag:
        description: 'Tag to release (e.g. 1.4.0)'
        required: true
        type: string

permissions:
  contents: write
  id-token: write
  attestations: write

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - name: Resolve tag ref
        id: resolve
        env:
          REF: ${{ github.ref }}
          INPUT_TAG: ${{ inputs.tag }}
        run: |
          if [ -n "$INPUT_TAG" ]; then
            echo "ref=refs/tags/$INPUT_TAG" >> "$GITHUB_OUTPUT"
          else
            echo "ref=$REF" >> "$GITHUB_OUTPUT"
          fi

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ steps.resolve.outputs.ref }}
          persist-credentials: false
      - uses: pnpm/action-setup@71c92474e7e4f5bca283fb17ef80fba9cdb2b4b1 # v6
      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          node-version-file: package.json
          cache: pnpm

      - name: Verify tag matches manifest version
        env:
          REF: ${{ steps.resolve.outputs.ref }}
        run: |
          tag="${REF#refs/tags/}"
          manifest_version=$(node -p "require('./manifest.json').version")
          if [ "$tag" != "$manifest_version" ]; then
            echo "tag ($tag) does not match manifest.json version ($manifest_version)" >&2
            exit 1
          fi
          if ! jq -e --arg v "$tag" 'has($v)' versions.json > /dev/null; then
            echo "version $tag is missing from versions.json" >&2
            exit 1
          fi

      - name: Verify release does not already exist
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REF: ${{ steps.resolve.outputs.ref }}
        run: |
          tag="${REF#refs/tags/}"
          if gh release view "$tag" --repo "$GITHUB_REPOSITORY" > /dev/null 2>&1; then
            echo "release $tag already exists; delete it first or bump the version" >&2
            exit 1
          fi

      - run: pnpm install --frozen-lockfile
      - run: pnpm check
      - run: pnpm build

      - name: Attest release artifacts
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        with:
          subject-path: |
            main.js
            manifest.json
            styles.css

      - name: Create release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REF: ${{ steps.resolve.outputs.ref }}
        run: |
          tag="${REF#refs/tags/}"
          prerelease_flag=""
          case "$tag" in
            *-*) prerelease_flag="--prerelease" ;;
          esac
          gh release create "$tag" \
            --title "$tag" \
            --generate-notes \
            $prerelease_flag \
            main.js manifest.json styles.css