name: Publish

on:
  push:
    branches: [main]
    paths:
      - 'oxibonsai/Project/Sources/**'
      - 'oxibonsai/Resources/**'
  pull_request:
    paths:
      - 'oxibonsai/**'
      - 'scripts/**'
      - 'upstream.json'
      - 'Cargo.lock'
      - 'component-dependencies.json'
      - '.github/actions/compile-component/**'
      - '.github/workflows/publish.yml'
  workflow_dispatch:
    inputs:
      use_self_hosted:
        type: boolean
        description: Use the trusted self-hosted macOS packaging runner
        required: true
        default: false
      mode:
        type: choice
        description: Component semantic version increment
        options: [patch, minor, major]
        required: true
        default: patch

permissions:
  contents: read

concurrency:
  group: ${{ github.event_name == 'pull_request' && format('component-pr-{0}', github.event.number) || 'component-resources-main' }}
  cancel-in-progress: false

jobs:
  validate:
    if: github.event_name == 'pull_request'
    runs-on: macos-15
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Validate committed resource closure
        run: |
          python3 scripts/package-server.py --verify-only --output oxibonsai/Resources/bin
          oxibonsai/Resources/bin/macOS/oxibonsai --version
      - uses: ./.github/actions/compile-component

  publish:
    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
    environment: component-publish
    permissions:
      contents: write
    runs-on: ${{ fromJSON(inputs.use_self_hosted == true && '["self-hosted","macos"]' || '["macos-15"]') }}
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0
      - name: Require clean, current main and committed native resources
        run: |
          set -euo pipefail
          test -z "$(git status --porcelain --untracked-files=normal)"
          git fetch origin main
          test "$(git rev-parse origin/main)" = "$GITHUB_SHA"
          python3 scripts/package-server.py --verify-only --output oxibonsai/Resources/bin
          oxibonsai/Resources/bin/macOS/oxibonsai --version
      - name: Bump component version locally, before generated files
        id: version
        env:
          VERSION_MODE: ${{ inputs.mode || 'patch' }}
        run: |
          set -euo pipefail
          npm version "$VERSION_MODE" --no-git-tag-version
          version=$(node -p 'require("./package.json").version')
          echo "version=$version" >> "$GITHUB_OUTPUT"
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add -- package.json
          git commit -m "Bump component to $version" \
            -m "Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>"
          git tag "$version"
      - name: Compile and verify committed resources
        uses: ./.github/actions/compile-component
      - name: Setup signing keychain
        id: keychain
        uses: miyako/4D/.github/actions/deployment-setup-keychain@v1
        with:
          APPLE_DEVELOPER_ID_CERTIFICATE: ${{ secrets.APPLE_DEVELOPER_ID_CERTIFICATE }}
          APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_DEVELOPER_ID_CERTIFICATE_PASSWORD }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
      - name: Sign all generated code and notarize fail-closed
        env:
          SIGNING_IDENTITY: ${{ secrets.CODESIGN_APPLE_ID }}
          KEYCHAIN_PATH: ${{ steps.keychain.outputs.KEYCHAIN_PATH }}
          APPLE_ID: ${{ secrets.NOTARYTOOL_APPLE_ID }}
          TEAM_ID: ${{ secrets.NOTARYTOOL_TEAM_ID }}
          NOTARY_PASSWORD: ${{ secrets.NOTARYTOOL_PASSWORD }}
        run: python3 scripts/sign-component.py
      - name: Push version commit and tag only after package gates
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          set -euo pipefail
          test -z "$(git status --porcelain --untracked-files=no)"
          git fetch origin main
          test "$(git rev-parse origin/main)" = "$GITHUB_SHA"
          git push --atomic origin HEAD:refs/heads/main "refs/tags/$VERSION:refs/tags/$VERSION"
      - name: Publish component assets
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          set -euo pipefail
          gh release create "$VERSION" --verify-tag --title "$VERSION" \
            oxibonsai.dmg oxibonsai.zip SHA256SUMS notarization.json
      - name: Remove signing keychain
        if: ${{ always() && steps.keychain.outputs.KEYCHAIN_PATH != '' }}
        env:
          KEYCHAIN_PATH: ${{ steps.keychain.outputs.KEYCHAIN_PATH }}
          CERTIFICATE_PATH: ${{ steps.keychain.outputs.CERTIFICATE_PATH }}
        run: |
          security delete-keychain "$KEYCHAIN_PATH"
          rm -f "$CERTIFICATE_PATH"