name: Publish UPM package

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    env:
      NODE_AUTH_TOKEN: ${{ secrets.SHRINKSDK_PACKAGE_TOKEN }}
    steps:
      - name: Fetch exact tagged release archive
        env:
          GITEA_REF: ${{ gitea.ref }}
        shell: bash
        run: |
          set -eu
          tag="${GITEA_REF#refs/tags/}"
          case "$tag" in
            v[0-9]*) ;;
            *) echo "Expected a version tag ref, got: $GITEA_REF" >&2; exit 1 ;;
          esac
          export SHRINKSDK_ARCHIVE_URL="https://git.crash.work/ShrinkSDK/ShrinkCommand.Integration.App/archive/${tag}.tar.gz"
          node --input-type=module <<'NODE'
          import { writeFile } from 'node:fs/promises';

          const response = await fetch(process.env.SHRINKSDK_ARCHIVE_URL);
          if (!response.ok) {
            throw new Error(`Release archive download failed: ${response.status} ${response.statusText}`);
          }

          await writeFile('release.tar.gz', new Uint8Array(await response.arrayBuffer()));
          NODE
          mkdir release
          tar -xzf release.tar.gz --strip-components=1 -C release
          rm -f release.tar.gz
          printf '%s' "$tag" > release/.shrink-sdk-release-tag

      - name: Validate immutable release version
        shell: bash
        run: |
          set -eu
          cd release
          tag="$(cat .shrink-sdk-release-tag)"
          version="$(node -p "require('./package.json').version")"
          test "$tag" = "v$version"
          npm pack --dry-run

      - name: Publish to ShrinkSDK registry
        shell: bash
        run: |
          set -eu
          : "${NODE_AUTH_TOKEN:?SHRINKSDK_PACKAGE_TOKEN is required}"
          cd release
          npmrc="$HOME/.npmrc"
          cleanup() { rm -f "$npmrc"; }
          trap cleanup EXIT
          printf '%s\n' \
            'registry=https://git.crash.work/api/packages/ShrinkSDK/npm/' \
            '//git.crash.work/api/packages/ShrinkSDK/npm/:_authToken=${NODE_AUTH_TOKEN}' > "$npmrc"
          npm publish --registry=https://git.crash.work/api/packages/ShrinkSDK/npm/