name: Validate and release

on:
  push:
    branches: [main]
    tags: ['v*']
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  validate:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: '24'
      - uses: pnpm/action-setup@v6
      - name: Install native direnv for integration tests
        run: sudo apt-get update && sudo apt-get install -y direnv
      - run: pnpm prepare:release
      - run: pnpm typecheck
      - run: pnpm test
      - run: pnpm release:pack
      - run: pnpm verify:consumer
      - uses: actions/upload-artifact@v7
        with:
          name: release
          path: .artifacts/release/
          if-no-files-found: error
          retention-days: 7

  release:
    if: startsWith(github.ref, 'refs/tags/v')
    needs: validate
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@v8
        with:
          name: release
          path: release
      - name: Publish a new version without replacing existing assets
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          RELEASE_TAG: ${{ github.ref_name }}
        run: gh release create "$RELEASE_TAG" release/*.tgz release/SHA256SUMS --verify-tag --title "$RELEASE_TAG" --notes-file release/release-notes.md