name: Release Automation

on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+"

concurrency: ci-release-automation

permissions:
  contents: read

jobs:
  release:
    timeout-minutes: 60
    environment: npm-release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
      attestations: write
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
        with:
          go-version-file: go.mod
          cache: true

      - name: Enable corepack
        run: corepack enable

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Extract version
        id: version
        shell: bash
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Install GoReleaser
        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
        with:
          install-only: true
          version: "~> v2"

      - name: Build release (goreleaser via Nx)
        run: pnpm nx run pmg:build-release
        env:
          GITHUB_TOKEN: ${{ secrets.GORELEASER_GITHUB_TOKEN }}

      - name: Attest Go binary provenance
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        with:
          subject-checksums: dist/checksums.txt

      - name: Publish npm packages (sync + build + publish via Nx)
        run: pnpm nx run pmg:publish-npm
        env:
          VERSION: ${{ steps.version.outputs.version }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

  test-installation:
    needs: release
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        node: ["18", "20", "22", "24"]
    steps:
      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: ${{ matrix.node }}

      - name: Extract version
        id: version
        shell: bash
        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"

      - name: Wait for package on registry
        shell: bash
        run: |
          for i in $(seq 1 20); do
            npm view "@safedep/pmg@${{ steps.version.outputs.version }}" version > /dev/null 2>&1 && break
            echo "Waiting... ($i/20)"
            sleep 30
            [ "$i" -eq 20 ] && echo "Package not available after 10 minutes" && exit 1
          done

      - name: Install
        run: npm install -g "@safedep/pmg@${{ steps.version.outputs.version }}"

      - name: Smoke test
        run: pmg version
