name: Publishment
on:
  push:
    branches:
      - main

jobs:
  test:
    uses: ./.github/workflows/basic-test.yml

  e2e-test:
    uses: ./.github/workflows/e2e-test.yml

  backwards-compatibility-test:
    needs: [test]
    uses: ./.github/workflows/backwards-compatibility-test.yml

  analysis:
    name: SonarCloud Main Analysis
    runs-on: ubuntu-latest
    needs: test
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis

      # Download reports
      - uses: ./.github/actions/download-coverage-report
      - uses: ./.github/actions/download-lint-report

      - name: SonarCloud Scan
        uses: SonarSource/sonarqube-scan-action@v6
        env:
          SONAR_TOKEN: ${{ secrets.SONARQUBE_SCANNER }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  release-preliminar:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/setup

      - name: Preliminar Version
        run: npx nx version ngx-deploy-npm  --dry-run

  release:
    environment: production
    runs-on: ubuntu-latest
    needs: [release-preliminar, e2e-test, test, backwards-compatibility-test]
    permissions:
      id-token: write # OIDC for npm trusted publishing
      contents: write # @jscutlery/semver:github (gh release create)
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/setup
        with:
          git_bot_token: ${{ secrets.GIT_BOT_TOKEN }}
          package-manager-cache: false

      - uses: ./.github/actions/download-build

      # npm trusted publishing (OIDC): no NPM_TOKEN. Configure the trusted
      # publisher on npmjs.com for workflow publishment.yml (see contributors doc).
      - name: Version and Publishment
        run: npx nx version ngx-deploy-npm
        env:
          GITHUB_TOKEN: ${{ secrets.GIT_BOT_TOKEN }}

      - name: Tag last-release
        run: git tag --force last-release

      - name: Push Tag last-release
        uses: ad-m/github-push-action@master
        with:
          github_token: ${{ secrets.GIT_BOT_TOKEN }}
          branch: ${{ github.ref }}
          force: true
          tags: true