name: Release

on:
  push:
    tags: ["v*"]

permissions:
  contents: read

concurrency:
  group: npm-release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    outputs:
      version: ${{ steps.package.outputs.version }}
      integrity: ${{ steps.package.outputs.integrity }}
    env:
      NODE_AUTH_TOKEN: ""
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.14
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 22
          registry-url: https://registry.npmjs.org
      - name: Install locked development dependencies
        run: bun install --frozen-lockfile
      - name: Verify release prerequisites
        run: bun run verify
      - name: Test release validation
        run: node --test test/release.test.mjs
      - name: Build the release package
        run: bun run --cwd apps/cli build
      - name: Pack and validate the selected version
        id: package
        env:
          RELEASE_TAG: ${{ github.ref_name }}
        run: node scripts/prepare-release.mjs "$RELEASE_TAG" "$RUNNER_TEMP/jevgrep-release"
      - name: Retain the verified release candidate
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: jevgrep-${{ steps.package.outputs.version }}
          path: ${{ runner.temp }}/jevgrep-release/
          if-no-files-found: error
      - name: Exercise the exact tarball in the Node-only runtime
        env:
          RELEASE_TARBALL: ${{ steps.package.outputs.tarball }}
        run: bash scripts/test-installed.sh --prebuilt "$RELEASE_TARBALL"
      - name: Dry-run publication of the verified tarball
        env:
          RELEASE_TARBALL: ${{ steps.package.outputs.tarball }}
          RELEASE_DIST_TAG: ${{ steps.package.outputs.dist_tag }}
        run: npm publish "$RELEASE_TARBALL" --access public --tag "$RELEASE_DIST_TAG" --ignore-scripts --dry-run
      - name: Publish the verified tarball
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          RELEASE_TARBALL: ${{ steps.package.outputs.tarball }}
          RELEASE_DIST_TAG: ${{ steps.package.outputs.dist_tag }}
        run: npm publish "$RELEASE_TARBALL" --access public --tag "$RELEASE_DIST_TAG" --ignore-scripts --provenance

  verify-registry:
    needs: release
    runs-on: ubuntu-latest
    env:
      NODE_AUTH_TOKEN: ""
      RELEASE_VERSION: ${{ needs.release.outputs.version }}
      RELEASE_INTEGRITY: ${{ needs.release.outputs.integrity }}
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.14
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 22
          registry-url: https://registry.npmjs.org
      - name: Prepare canonical parser assets for archive validation
        run: |
          bun install --frozen-lockfile --ignore-scripts
          bun scripts/parser-assets.mjs
      - name: Retrieve the exact public registry version
        run: |
          mkdir -p "$RUNNER_TEMP/jevgrep-registry"
          # npm can accept publication before the public registry exposes it.
          for attempt in {1..12}; do
            if npm pack "@dzhng/jevgrep@$RELEASE_VERSION" --ignore-scripts --pack-destination "$RUNNER_TEMP/jevgrep-registry"; then
              break
            fi
            if [ "$attempt" -eq 12 ]; then
              exit 1
            fi
            echo "Waiting for the published version to become available (attempt $attempt/12)."
            sleep 15
          done
      - name: Match the registry archive to the verified candidate
        run: node scripts/validate-release.mjs "$RUNNER_TEMP/jevgrep-registry/dzhng-jevgrep-$RELEASE_VERSION.tgz" "v$RELEASE_VERSION" "$RELEASE_INTEGRITY"
      - name: Install registry bytes fresh and run installed journeys
        run: bash scripts/test-installed.sh --prebuilt "$RUNNER_TEMP/jevgrep-registry/dzhng-jevgrep-$RELEASE_VERSION.tgz"