name: Release

on:
  push:
    tags:
      - '*.*.*'

jobs:
  release:
    runs-on: pixi-build-rust
    permissions:
      contents: write
    env:
      CARGO_TARGET_DIR: /opt/cargo-target/${{ gitea.repository }}
      API: ${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}
      TOKEN: ${{ secrets.GITEA_TOKEN }}
      TAG: ${{ gitea.ref_name }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Check the tag matches the crate version
        run: |
          set -euo pipefail
          version=$(grep -m1 '^version' Cargo.toml | sed -E 's/.*"([^"]+)".*/\1/')
          tag="${TAG#v}"
          if [ "$tag" != "$version" ]; then
            echo "tag ${TAG} does not match Cargo.toml version ${version}" >&2
            exit 1
          fi

      - name: Install the pinned toolchain
        run: pixi install

      - name: Build the full bundle (binary and license notices)
        run: |
          pixi run setup-tools
          pixi run dist

      - name: Package and publish the release
        run: |
          set -euo pipefail
          auth="Authorization: token ${TOKEN}"
          jq() { pixi exec --spec jq -- jq "$@"; }

          version=$(grep -m1 '^version' Cargo.toml | sed -E 's/.*"([^"]+)".*/\1/')
          asset="coursebank-${version}-linux-x64.tar.gz"
          tar -czf "$asset" -C dist coursebank LICENSE.md THIRD-PARTY-LICENSES.txt
          sha256sum "$asset" > "$asset.sha256"

          rid=$(curl -fsSL -X POST -H "$auth" -H "Content-Type: application/json" \
            "${API}/releases" \
            -d "$(jq -n --arg tag "$TAG" \
                  '{tag_name:$tag, name:$tag, body:"See CHANGELOG.md.", draft:false, prerelease:false}')" \
            | jq -r '.id')

          for f in "$asset" "$asset.sha256"; do
            curl -fsSL -X POST -H "$auth" \
              -F "attachment=@${f}" \
              "${API}/releases/${rid}/assets?name=${f}"
          done