name: Publish UPM package

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    env:
      NODE_AUTH_TOKEN: ${{ secrets.SHRINKSDK_PACKAGE_TOKEN }}
    steps:
      - name: Install Git
        shell: bash
        run: |
          set -eu
          if ! command -v git >/dev/null 2>&1; then
            apt-get update
            DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends git ca-certificates
            rm -rf /var/lib/apt/lists/*
          fi

      - name: Fetch tagged revision
        shell: bash
        run: |
          set -eu
          ref="${{ gitea.sha }}"
          test -n "$ref"
          git init .
          git remote add origin "https://git.crash.work/ShrinkSDK/ShrinkCommand.Integration.EventBus.git"
          git fetch --depth=1 --tags origin "$ref"
          git checkout --detach FETCH_HEAD

      - name: Validate immutable release version
        shell: bash
        run: |
          set -eu
          tag="$(git describe --exact-match --tags HEAD)"
          version="$(node -p "require('./package.json').version")"
          test "$tag" = "v$version"
          npm pack --dry-run

      - name: Publish to ShrinkSDK registry
        shell: bash
        run: |
          set -eu
          : "${NODE_AUTH_TOKEN:?SHRINKSDK_PACKAGE_TOKEN is required}"
          npmrc="$HOME/.npmrc"
          cleanup() { rm -f "$npmrc"; }
          trap cleanup EXIT
          printf '%s\n' \
            'registry=https://git.crash.work/api/packages/ShrinkSDK/npm/' \
            '//git.crash.work/api/packages/ShrinkSDK/npm/:_authToken=${NODE_AUTH_TOKEN}' > "$npmrc"
          npm publish --registry=https://git.crash.work/api/packages/ShrinkSDK/npm/