name: Release

# Publishes the packages to npm ONLY when a v* tag is pushed.
# The owner cuts a release with, e.g.:  git tag v0.1.0 && git push origin v0.1.0
on:
  push:
    tags:
      - "v*"

permissions:
  id-token: write
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Setup Node (npm registry + provenance auth)
        uses: actions/setup-node@v4
        with:
          node-version: 22
          registry-url: "https://registry.npmjs.org"

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build all packages
        run: bun run -F '*' build

      # `npm publish` does NOT rewrite `workspace:*` dependency ranges (unlike
      # `bun publish`), so without this step the tarballs ship
      # `"@opa.sh/analytics-react": "workspace:*"` and are uninstallable off the
      # workspace. Rewrite every workspace: range to `^<version>` before
      # publishing (all packages are versioned in lockstep).
      - name: Rewrite workspace deps to concrete versions
        run: |
          for pkg in analytics analytics-react analytics-next; do
            node --input-type=module -e '
              import fs from "node:fs";
              const path = `packages/${process.argv[1]}/package.json`;
              const p = JSON.parse(fs.readFileSync(path, "utf8"));
              for (const field of ["dependencies", "peerDependencies", "optionalDependencies"]) {
                const deps = p[field];
                if (!deps) continue;
                for (const [name, range] of Object.entries(deps)) {
                  if (typeof range === "string" && range.startsWith("workspace:")) {
                    deps[name] = `^${p.version}`;
                  }
                }
              }
              fs.writeFileSync(path, JSON.stringify(p, null, "\t") + "\n");
            ' "$pkg"
          done
          echo "Deps after rewrite:"
          grep -H "@opa.sh/analytics" packages/*/package.json || true

      # Publish in dependency order: the core first, then the packages that
      # depend on it. --provenance requires the id-token permission above.
      - name: Publish @opa.sh/analytics
        run: npm publish --access public --provenance
        working-directory: packages/analytics
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Publish @opa.sh/analytics-react
        run: npm publish --access public --provenance
        working-directory: packages/analytics-react
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Publish @opa.sh/analytics-next
        run: npm publish --access public --provenance
        working-directory: packages/analytics-next
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      # ---------------------------------------------------------------------
      # Browser CDN bundle: build the raw minified IIFE and upload it to the
      # Opa CDN (Cloudflare R2). Customers load it as a single <script> tag
      # from ${R2_PUBLIC_URL}/sdk.js. Runs only after npm publish succeeds.
      # ---------------------------------------------------------------------
      - name: Build browser SDK (sdk.js)
        run: bun run --cwd packages/analytics build:sdk

      - name: Upload SDK to Cloudflare R2
        # We sign the PUT ourselves (scripts/upload-r2.py, pure stdlib) instead
        # of using the AWS CLI. Recent aws-cli v2 attaches CRC32 request
        # checksums with aws-chunked streaming trailers by default, which R2
        # rejects with SignatureDoesNotMatch even with
        # AWS_REQUEST_CHECKSUM_CALCULATION=when_required. Our signer sends a
        # plain SHA256 payload hash and no trailers, so there is nothing for R2
        # to disagree about. Region for R2 is always `auto` (baked into script).
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
          R2_BUCKET: ${{ secrets.R2_BUCKET }}
          R2_KEY: sdk.js
          R2_BODY: packages/analytics/dist/sdk.js
        run: python3 scripts/upload-r2.py