name: "Releases"

on:
  workflow_dispatch:
  push:
    tags:
      - "v*"

permissions:
  contents: read

env:
  REGISTRY: ghcr.io
  REGISTRY_USER: ${{ github.actor }}
  REGISTRY_PASSWORD: ${{ github.token }}
  IMAGE_NAME: ${{ github.repository }}

jobs:
  main:
    permissions:
      packages: write
      contents: write
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set node version
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          registry-url: "https://registry.npmjs.org"

      - name: Install
        run: |
          npm ci
          npm run setheapsize

      - name: Lint
        run: npx grunt lint

      - name: Unit Tests
        run: |
          npm test
          npm run testnodeconsumer

      - name: Production Build
        run: npx grunt prod

      - name: Setup Chrome
        id: setup-chrome
        if: success()
        run: |
          npx @puppeteer/browsers install chrome@148
          echo chromedir=$(dirname $(find `pwd`/chrome/* -name chrome -print -quit)) >> $GITHUB_OUTPUT

      - name: UI Tests
        if: success()
        run: |
          export PATH=${{ steps.setup-chrome.outputs.chromedir }}:$PATH
          sudo apt-get install xvfb
          xvfb-run --server-args="-screen 0 1200x800x24" npx grunt testui

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

      - name: Image Metadata
        id: image-metadata
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=semver,pattern={{major}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{version}}

      - name: Log in to GHCR
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ env.REGISTRY_USER }}
          password: ${{ env.REGISTRY_PASSWORD }}

      - name: Publish to GHCR
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          push: true
          tags: ${{ steps.image-metadata.outputs.tags }}
          labels: ${{ steps.image-metadata.outputs.labels }}
          platforms: linux/amd64,linux/arm64,linux/arm/v7

      - name: Upload Release Assets
        id: upload-release-assets
        uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # v2
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          file: build/prod/*.zip
          tag: ${{ github.ref }}
          overwrite: true
          file_glob: true
          body: "See the [CHANGELOG](https://github.com/gchq/CyberChef/blob/master/CHANGELOG.md) and [commit messages](https://github.com/gchq/CyberChef/commits/master) for details."

  npm-publish:
    permissions:
      id-token: write
      contents: read
    needs: main
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set node version
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
          registry-url: "https://registry.npmjs.org"

      - name: Install
        run: npm ci

      - name: Create machine generated files
        run: npm run node

      - name: Publish to NPM
        run: npm publish